Policy
NTLM Enhanced Blocking
Microsoft Windows
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows11
This policy setting allows the NTLM security package to block NTLM authentication requests based on the new, enhanced blocking policies at the Machine level. These enhanced blocking policies allow you to block NTLM authentication based on new criteria, such as the type of the account, the role of the device, or the type of application. If the overall policy is set to "Disabled" or "Not Configured", the subsettings below will not take effect. If the overall policy is set to "Enabled", the subpolicies below will take effect based on their configuration. Unless configured, all policies are set to "Audit" mode. Policies that are set to "Audit" will log a warning about the NTLM request that could be blocked, but will not block it. Multiple policies that are marked as "Audit" can be enabled at the same time, and they will be logged in an unified event log. If any policy is marked as "Enabled", the NTLM authentication request will be blocked if it matches the criteria of the policy. If multiple policies are marked as "Enabled", the NTLM authentication request will be blocked if it matches the criteria of any of the policies. An event log will be generated for the first policy that blocks the NTLM authentication. In scenarios where there are both "Audit" and "Enabled" policies, the "Enabled" policy will take precedence. All of the enhanced blocking policies outlined here share the same allow list, which specifies the accounts, devices, and applications that are allowed to use NTLM authentication. The allow list can contain a series of target names or SPNs to allow the authentication. For more information, please visit aka.ms/ntlmlogandblock.
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
| Computer | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters Value name EnhancedNtlmBlocks | REG_DWORD | HKLM 1 | HKLM 0 |
Policy elements
Inputs and configuration options exposed by this policy.
| Scope | Element | Type | Registry mapping | Constraints & behavior | Copy |
|---|---|---|---|---|---|
| Computer | Specify the allow list for enhanced blocking policies: ID EnhancedMachineBlockingWithAllowListBox | list | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters Value name EnhancedMachineBlockingAllowList Type REG_MULTI_SZ | None | |
| Computer | Block NTLM for Domain Accounts Single Sign-On ID DomainSingleSignOnDropDown | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters Value name BlockDomainAccountSSO Type REG_DWORD | Options: Audit (1), Enabled (2), Disabled (0) | |
| Computer | Block NTLM for Domain Controllers ID DomainControllerAuthDropDown | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters Value name BlockDomainControllerAuth Type REG_DWORD | Options: Audit (1), Enabled (2), Disabled (0) | |
| Computer | Block NTLM when Machine binding fails ID MachineBindingDropDown | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters Value name EnforceMachineBinding Type REG_DWORD | Options: Audit (1), Enabled (2), Disabled (0) | |
| Computer | Block all NTLM authentication ID BlockAllDropDown | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\NTLM\Parameters Value name BlockAll Type REG_DWORD | Options: Audit (1), Enabled (2), Disabled (0) |