The Policy Expert: Network security: LAN Manager authentication level

Share

NTLM attacks are especially relevant to Active Directory environments. One of the most common attack vectors is NTLM Relay, where the attacker compromises one machine and then spreads laterally to other machines by using NTLM authentication directed at the compromised server. The best way to cope with NTLM vulnerabilities is basically not to use NTLM, as there are better and safer authentication methods out there. But easier said than done, because most large and veteran infrastructures contain machines that can only use NTLM. Is this case, it is important to make sure they are configured in the most secure fashion possible.

NTLMv1 or NTLMv2? Does it even matter?

POLICY DESCRIPTION:

LAN Manager (LM) is a family of early Microsoft client/server software that allows users to link personal computers together on a single network. Network capabilities include transparent file and print sharing, user security features, and network administration tools. In Active Directory domains, the Kerberos protocol is the default authentication protocol. However, if the Kerberos protocol is not negotiated for some reason, Active Directory will use LM, NTLM, or NTLMv2.

LAN Manager authentication includes the LM, NTLM, and NTLM version 2 (NTLMv2) variants, and is the protocol that is used to authenticate all Windows clients when they perform the following operations:

1. Join a domain
2. Authenticate between Active Directory forests
3. Authenticate to down-level domains
4. Authenticate to computers that do not run Windows 2000, Windows Server 2003, or Windows XP
5. Authenticate to computers that are not in the domain

The possible values for the Network security: LAN Manager authentication level setting are:

1. Send LM & NTLM responses- Clients use LM and NTLM authentication and never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.
2. Send LM & NTLM — use NTLMv2 session security if negotiated- Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.
3. Send NTLM responses only- Clients use NTLM authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.
4. Send NTLMv2 responses only- Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.
5. Send NTLMv2 responses only\refuse LM- Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM (accept only NTLM and NTLMv2 authentication).
6. Send NTLMv2 responses only\refuse LM & NTLM- Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and NTLM (accept only NTLMv2 authentication).
7. Not Defined

POTENTIAL VULNERABILITY:

Default configurations:

Windows Vista- Not Defined

Windows 95-based and Windows 98-based clients only send LM.

Windows 2000, Windows Server 2003, and Windows XP- send LM and NTLM authentication responses.

Windows 95, Windows 98, and Windows NT operating systems cannot use the Kerberos version 5 protocol for authentication. For this reason, in a Windows Server 2003 domain, computers authenticate by default with both the LM and NTLM protocols.

The default setting on those servers allows all clients to authenticate with servers and use their resources. However, this means that LM responses—the weakest form of authentication response—are sent over the network, and it is potentially possible for attackers to sniff that traffic and easily reproduce the user’s password.

You can enforce a more secure authentication protocol for Windows 95, Windows 98, and Windows NT by using NTLMv2. For the logon process, NTLMv2 uses a secure channel to protect the authentication process. Even if you use NTLMv2 for earlier clients and servers, Windows-based clients and servers that are members of the domain will use the Kerberos authentication protocol to authenticate with Windows Server 2003 domain controllers.

Mitigating relay NTLM remote code execution vulnerability

COUNTERMEASURES:

Configure the Network security: LAN Manager Authentication Level setting to Send NTLMv2 responses only. We recommend this level of authentication when all clients support NTLMv2.

For more information about how to enable NTLMv2 on older versions of Windows, see article 239869. Microsoft Windows NT 4.0 requires Service Pack 4 (SP4) to support NTLMv2, and Windows 95 and Windows 98 platforms need the directory service client installed to support NTLMv2.

POTENTIAL IMPACT:

Clients that do not support NTLMv2 authentication will not be able to authenticate in the domain and access domain resources by using LM and NTLM. You can follow this guide to help determine where NTLM may be used within your environment.

SEVERITY:

Critical

RECOMMENDED VALUE:

Send NTLMv2 response only. Refuse LM.

Note: if set to Send NTLMv2 response only, Refuse LM & NTLM will not be able to access IIS applications unless the client\workstation is also set with the same configuration. Other applications might not work properly as well.

Automating IIS Hardening with PowerShell

HOW TO CONFIGURE:

To configure NTLM compatibility for Windows Vista and Windows 7:

1. Click Start > All Programs > Accessories > Run and type secpol.msc in the Open box, and then click OK.
2. Click Local Policies > Security Options > Network Security: LAN Manager authentication level.
3. Click Send LM & NTLM – use NTLMv2 session security if negotiated.
4. Click Apply.

Configuring GPO to Force NTLMv2

Go to the GPO section Computer Configurations -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options and find the policy Network Security: LAN Manager authentication level.

You can also disable NTLMv1 through the registry. To do it, create a DWORD parameter with the name LmCompatibilityLevel and the value 0-5 in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lsa. Value 5 corresponds to the policy option “Send NTLMv2 response only. Refuse LM NTLM”.

AUTOMATE YOUR SERVER HARDENING:

Server hardening can be a painful procedure. If you’re reading this article, you probably already know it. Endless hours, labor and money are invested in this process, which can often result in production breakdown despite the effort to prevent it. CSH by CalCom is automating the entire server hardening process. CHS’s unique ability to ‘learn’ your network abolishes the need to perform lab testing while ensuring zero outages to your production environment. CHS will allow you to implement your policy directly on your production hassle-free. want to know more?

Click here and get the datasheet. 

http://woshub.com/disable-ntlm-authentication-windows/

Facebook

Twitter

Linkedin

email