NTLMv1.1 Detection
Summary
This document checks whether NTLMv1.1 is enabled on the end machine.
Details
Suggested "Limit to": Managed Windows Computers
Suggested Alert Style: Once
Suggested Alert Template: Default Do Nothing
Insert the details of the monitor in the table below.
| Check Action | Server Address | Check Type | Check Value | Comparator | Interval | Result |
|---|---|---|---|---|---|---|
| System | 127.0.0.1 | Run File | REDACTED | State Based | 900 |  |
Target
Managed Windows Computers
Dependencies
EPM - Windows Configuration - Dataview - NTLMv1.1 Status [Remote Monitor]
How to Import
Import - Remote Monitor - NTLMv1.1 Detection
Changelog
2025-04-10
- Initial version of the document