Enforce Strict NTLM Levels Using Regedit

Securing Windows network authentication requires disabling legacy, vulnerable protocols like LM (LAN Manager) and NTLMv1 in favor of the more secure NTLMv2. This article provides a direct guide for system administrators to enforce strict NTLM authentication levels across Windows environments by manually configuring the Windows Registry using the Registry Editor (Regedit).

Registry Location and Parameter

To configure the NTLM authentication level, modify the LmCompatibilityLevel registry entry located in the Local Security Authority (LSA) key:

• Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
• Value Name: LmCompatibilityLevel
• Data Type: REG_DWORD (32-bit Value)

NTLM Level Values Explained

The LmCompatibilityLevel parameter accepts integer values from 0 to 5. To enforce strict security, administrators should select level 4 or level 5:

• 0: Send LM and NTLM responses; never use NTLMv2 session security.
• 1: Send LM and NTLM; use NTLMv2 session security if negotiated.
• 2: Send NTLM response only.
• 3: Send NTLMv2 response only (Client sends NTLMv2; domain controllers accept LM, NTLM, and NTLMv2).
• 4: Send NTLMv2 response only; domain controllers refuse LM responses.
• 5: Send NTLMv2 response only; domain controllers refuse both LM and NTLM responses (Strict NTLMv2-only mode).

Step-by-Step Configuration Guide

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.

2. Navigate to the following key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3. Locate the LmCompatibilityLevel entry in the right pane. If it does not exist, right-click the empty space, select New > DWORD (32-bit) Value, and name it LmCompatibilityLevel.

4. Double-click LmCompatibilityLevel to open its properties.

5. Under Base, select Decimal or Hexadecimal (values 0–5 are identical in both).

6. Set the Value data to 5 to enforce the strictest setting (refuse LM and NTLMv1, accept only NTLMv2). Alternatively, set it to 3 for client-only strict enforcement.

7. Click OK to save the changes.

8. Close the Registry Editor.

Verification and Application

The new NTLM authentication settings take effect immediately for new connections, but a system reboot is recommended to ensure all active Local Security Authority Subsystem Service (LSASS) sessions and background services adopt the new authentication constraints. Ensure all network devices, legacy applications, and non-Windows clients support NTLMv2 before enforcing level 5 across production environments to prevent authentication failures.