Audit NTLM v1 on DC

Windows Server 2025 no longer supports NTLM v1 (which shouldn't exist on your network). However, just to be safe before updating domain controllers, we should verify.

The following script queries relevant events from the security log (fast using FilterXPath) and groups them.

If all of the events returned are for ANONYMOUS LOGON then you can ignore them. The logging logic in Windows gives false positives for NTLM v1 with anonymous authentication. When it doesn't see NTLM v2, it logs it as NTLM v1.

More info here: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/audit-domain-controller-ntlmv1

$cred = Get-Credential

#Query only events with NTLM V1 (1 min or less per DC)
$comp = "XXXXXXX"
$xpath = "*[System[EventID=4624] and EventData[Data[@Name='LMPackageName']='NTLM V1']]"
$LogonEvents = Get-WinEvent -ComputerName $comp -Credential $cred -FilterXPath $xpath -LogName Security

foreach ($event in $LogonEvents) {

    $lines = $event.message -split '\r?\n'
    $AcctLine = $lines | where {$_ -like "*Account Name:*"} 
    $Acct = ($AcctLine[1] -split ":")[1].trim()
    $event | Add-Member -NotePropertyName Account -NotePropertyValue $Acct -force


    $NTLM = $lines | where {$_ -like "*Package Name (NTLM only):*"} 
    $NTLMVersion = ($NTLM -split ":")[1].trim()
    $event | Add-Member -NotePropertyName NTLMVersion -NotePropertyValue $NTLMVersion -force

    $WS = $lines | where {$_ -like "*Workstation Name:*"} 
    $WSName = ($WS -split ":")[1].trim()
    $event | Add-Member -NotePropertyName Workstation -NotePropertyValue $WSName -force

} #end foreach

#Make sure only NTLM v1
$LogonEvents | Group-Object -Property NTLMVersion

#Can ignore ANONYMOUS LOGON
$logonevents | where NTLMVersion -eq "NTLM V1" | Group-Object Account

#In case you care which computers they're coming from
$LogonEvents | Group-Object Workstation