Overview
The NTLMSettings command enumerates NTLM authentication configuration settings on the system. These settings control how NTLM authentication is used, including security levels, client/server requirements, and restrictions that impact credential relay and pass-the-hash attacks.Syntax
Remote Execution
Output
Returns NTLM configuration including:- LAN Manager authentication level
- NTLM minimum security settings
- Client/Server requirements
- Session security settings
- NTLM blocking configuration
Use Cases
- Red Team
- Blue Team
- Assess NTLM relay vulnerability
- Determine if NTLMv1 is allowed
- Check SMB signing requirements
- Plan credential relay attacks
- Identify weak authentication settings
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
Low detection risk - reads registry configuration.
Related Commands
- LSASettings - LSA configuration
- CredGuard - Credential Guard status
- LogonSessions - Active logon sessions