Enforce Strict NTLM Session Security Using Regedit

This article explains how administrators can use the Windows Registry Editor (Regedit) to enforce strict NTLM session security on a local machine. Implementing these settings helps protect authentication traffic against downgrade attacks, credential interception, and unauthorized relaying by requiring high-level encryption standards for all local NTLM communications.

Registry Configuration Steps

To configure strict NTLM session security on a local Windows system, follow these steps:

1. Open the Registry Editor:

   • Press Win + R, type regedit, and press Enter.
   • If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

2. Navigate to the LSA Configuration Key: Go to the following registry path in the navigation pane:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

3. Configure Minimum Client Security:

   • In the right pane, locate the DWORD (32-bit) Value named NTLMMinClientSec. If it does not exist, right-click an empty space, select New > DWORD (32-bit) Value, and name it NTLMMinClientSec.
   • Double-click NTLMMinClientSec.
   • Set the Base to Hexadecimal.
   • Enter the value data corresponding to the required security level:
     • 0x20080000 (Decimal: 537395200): Enforces NTLMv2 session security and requires 128-bit encryption.
     • 0x00080000 (Decimal: 524288): Requires 128-bit encryption only.
     • 0x00080010 (Decimal: 524304): Enforces NTLMv2 session security and 128-bit encryption.

4. Configure Minimum Server Security:

   • In the same key (MSV1_0), locate or create the DWORD (32-bit) Value named NTLMMinServerSec.
   • Double-click NTLMMinServerSec.
   • Set the Base to Hexadecimal.
   • Enter the matching value data (typically 0x20080000 or 0x00080010) to enforce the same strict security standards for inbound authentication sessions.

5. Apply the Changes:

   • Close the Registry Editor.
   • Restart the computer for the new security policies to take effect across all network stacks and local authentication providers.

Value Breakdown

The values set in NTLMMinClientSec and NTLMMinServerSec represent bitmasks defined by Windows authentication providers:

• 0x00000010: Requires NTLMv2 session security (message integrity and confidentiality).
• 0x00000020: Requires key exchange.
• 0x00080000: Requires 128-bit encryption.
• 0x20000000: Enforces strict NTLMv2 key exchange.

Combining these flags into 0x20080000 or 0x00080010 ensures that the client and server reject any NTLM authentication negotiations that fail to meet modern cryptographic standards. Ensure all communicating endpoints support these settings prior to deployment to prevent service disruption.