> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# PREVENT-1

> Patch site server with KB15599094

## Summary

Within SCCM's client push installation properties, there exists a setting to "Allow connection fallback to NTLM" (Figure 1).

<Frame caption="Figure 1 - Client Push Installation Properties">
  <img src="https://mintcdn.com/specteropsdocs/k1yx6gbUDEwWUifq/misconfiguration-manager-docs/defense-techniques/PREVENT/PREVENT-1/prevent-1_ntlm-fallback.png?fit=max&auto=format&n=k1yx6gbUDEwWUifq&q=85&s=15b2a0b57969727f08af4a661855ab8b" alt="Client Push Installation Properties" width="518" height="543" data-path="misconfiguration-manager-docs/defense-techniques/PREVENT/PREVENT-1/prevent-1_ntlm-fallback.png" />
</Frame>

In SCCM versions prior to 2207, there exists a bug such that without this setting enabled, the connection will fallback to NTLM regardless of the setting. Microsoft patched this bug in [KB15599094](https://learn.microsoft.com/en-us/mem/configmgr/hotfix/2207/15599094). This patch is applied by default to new site installations of version 2207+.

This patch only applies to versions 2103+. If the installed version is older, Microsoft recommends updating to a current version.

## Linked Defensive IDs

* [PREVENT-2: Disable Fallback to NTLM](../PREVENT-2/prevent-2_description)

## Associated Offensive IDs

* [ELEVATE-2: NTLM relay via automatic client push installation](../../../attack-techniques/ELEVATE/ELEVATE-2/ELEVATE-2_description)
* [ELEVATE-3: NTLM relay via automatic client push installation and AD System Discovery](../../../attack-techniques/ELEVATE/ELEVATE-3/ELEVATE-3_description)

## References

* Microsoft, [NTLM client installation update for Microsoft Endpoint Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/hotfix/2207/15599094)
* Jitesh Kumar, [SCCM Hotfix KB15599094 NTLM Client Installation Update](https://www.anoopcnair.com/sccm-hotfix-kb15599094-ntlm-client-installation/)
* Brandon Colley, [Push Comes To Shove: Bypassing Kerberos Authentication of SCCM Client Push Accounts](https://www.hub.trimarcsecurity.com/post/push-comes-to-shove-bypassing-kerberos-authentication-of-sccm-client-push-accounts)