3 ways to implement NTLMv2 only on Windows machines

The importance of using “Send NTLMv2 response only. Refuse LM & NTLM” in Windows machines is to reinforce network authentication security.

Here’s what it does :

✅ Use NTLMv2 only : This policy configures client devices to use only NTLMv2 for authentication. NTLMv2 is a more secure version of the NTLM protocol, offering better protection against replay and man-in-the-middle attacks.

✅ Refuse older versions : Refuses authentication using less secure versions of LM (LAN Manager) and NTLM (NTLMv1). This prevents devices and services that do not support NTLMv2 from authenticating, thus increasing overall network security.

In short, this policy helps ensure that only the most secure authentication methods are used, reducing the risk of credentials being compromised.

1 – Steps Using GPO :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security\LAN Manager authentication level

To the following value : Send NTLMv2 response only. Refuse LM & NTLM

2 – Steps Using PowerShell :

This script must be executed as Administrator :

 $RegistryPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' 
$Name  = 'LmCompatibilityLevel'
$Value   = '5'

New-ItemProperty -Path $RegistryPath -Name $Name -Value $Value -PropertyType DWORD -Force 

3 – Steps Using Intune :

From Intune Admin center follow this steps :

Thanks