.png?width=100&auto=webp&quality=80&disable=upscale "Picture of John Savill")
.png?width=400&auto=webp&quality=80&disable=upscale "John Savill")
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
How do I disable LanManager challenge/response in NT?
John Savill
December 21, 1999
1 Min Read
A. Windows NT Servers with Service Pack 4 and above support threeauthentication types,
LanManager (LM) challenge/response
Windows NT challenge/response (also known as NTLM challenge/response)
Windows NT challenge/response Version 2.0 (also known as NTLM2)
By default when a client connects to a server both LM and NTLM are used incase the server does not support NTLM however LM is far weaker than NTLM so youmay wish to disable LM for security reasons.
Editing the registry key described allows the client to select whichauthentication is will use but ensure is NTLM2 is select SP4 is applied to allservers. The setting below is required on the clients and servers so you maywish to automate this via a logon script or policy
Start the registry editor
Move to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa
From the edit menu select New - DWORD value
Enter a name of LMCompatibilityLevel and press Enter
Double click the new value and set to one of the following
0 - Send LM response and NTLM response; never use NTLMv2 session security
1 - Use NTLMv2 session security if negotiated
2 - Send NTLM response only
3 - Send NTLMv2 response only
4 - DC refuses LM responses
5 - DC refuses LM and NTLM responses (accepts only NTLMv2)Close the registry editor
Reboot the machine
For more information on deploying seehttp://support.microsoft.com/support/kb/articles/q147/7/06.asp
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
