Network security: LAN Manager authentication level

Purpose

Show registry keys (1)

• HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel

The DWORD value 5 corresponds to Send NTLMv2 responses only. Refuse LM & NTLM. For network logons that use NTLM challenge-response authentication, the computer generates only NTLMv2 responses when acting as a client. It also uses NTLMv2 session security when the remote system supports it.

On a domain controller, this value additionally rejects incoming LM and NTLMv1 authentication. Only NTLMv2 is accepted for this type of authentication.

Notes

Security

This setting prevents the use of the older LM and NTLMv1 response mechanisms, reducing exposure to weaknesses associated with those legacy authentication methods. Compared with the older protocols, NTLMv2 incorporates additional data such as a client challenge and timestamp, helping to resist basic replay attacks.

The value does not disable the NTLM protocol family or require Kerberos. It controls which NTLM variant may be used when network authentication falls back to NTLM. It therefore does not eliminate every security risk associated with NTLM-based authentication.

Possible side effects

Legacy devices, operating systems, services, or applications that support only LM or NTLMv1 can no longer authenticate through those protocols. This may cause domain authentication failures or prevent access to domain resources from incompatible clients.

Notes

LmCompatibilityLevel is a computer-wide DWORD value. The behavior described here applies specifically to value data 5; other values permit different combinations of LM, NTLMv1, and NTLMv2.

The setting governs challenge-response authentication for network logons. Kerberos remains the preferred authentication protocol in Active Directory domains when it can be negotiated successfully.

Microsoft documentation

Microsoft Learn: Network security: LAN Manager authentication level

Microsoft Learn: Passwords technical overview

See also

• Entry in the reference