Determining which NTLM version is used
It is useful to be able to find out which NTLM versions your SharePoint site is configured to use. This applies if you are using the IWA (NTLM only) configuration. See our guides for SharePoint 2007 and for SharePoint 2010.
You can find which NTLM version is used in your registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\LMCompatibilityLevel.
Once you have the registry open, determine the value data (0 - 5):
Level |
Group Policy Name |
Sends |
Accepts |
Prohibits Sending |
|---|---|---|---|---|
0 |
Send LM and NTLM Responses |
LM, NTLM |
NTLMv2 Session Security is negotiated |
LM, NTLM, NTLMv2 |
1 |
Send LM and NTLM---use NTLMv2 session security if negotiated |
LM, NTLM |
LM, NTLM, NTLMv2 |
NTLMv2 |
2 |
Send NTLM response only |
NTLM |
LM, NTLM, NTLMv2 |
LM and NTLMv2 |
3 |
Send NTLMv2 response only |
NTLMv2 |
LM, NTLM, NTLMv2 |
LM and NTLM |
4 |
Send NTLMv2 response only/refuse LM |
NTLMv2 Session Security |
NTLM, NTLMv2 |
LM |
5 |
Send NTLMv2 response only/refuse LM and NTLM |
NTLMv2, Session Security |
NTLMv2 |
LM and NTLM |
Source Microsoft TechNet Magazine
More detailed discussion can be found here.