Topic starter
06/06/2026 11:32 am
TL;DR: LAN Manager authentication level 2 on domain controllers allows NTLMv1 both inbound and outbound, which attackers can coerce and relay to gain DC control, according to Semperis. Level 3 preserves legacy compatibility while removing the outbound attack path, so the minimum safe baseline is usually being missed.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “What You’re Missing: Proper LAN Manager Authentication Levels”.
Key questions
Q: What breaks when domain controllers stay on LAN Manager authentication level 2?
A: Level 2 lets domain controllers accept inbound NTLMv1 and also use NTLMv1 outbound, which creates a relay and coercion path that attackers can exploit.
Q: Why do domain controllers with NTLMv1 enabled increase domain compromise risk?
A: Because attackers can coerce a controller into authenticating outward, then relay that weaker authentication into directory actions such as shadow credentials or RBCD.
Q: How do security teams know whether their DC authentication baseline is too permissive?
A: If a domain controller can still initiate NTLMv1 outbound, the baseline is too permissive for privileged infrastructure.
Practitioner guidance
- Set domain controllers to level 3 Retain inbound NTLMv1 compatibility for legacy clients, but stop domain controllers from initiating outbound NTLMv1 connections.
- Audit coercion-prone services Review printers, DFS, and related services that can force a controller into an outbound authentication attempt.
- Enforce LDAP channel binding Block relay paths by requiring LDAP channel binding on systems that would otherwise accept relayed machine-account authentication.
Bottom line: The core risk is not NTLMv1 inbound compatibility on its own, but domain controllers initiating weak outbound authentication that attackers can coerce and relay.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 12:24 pm
Level 2 is a privileged identity exposure problem, not a legacy compatibility setting. The mistake is to treat inbound acceptance and outbound initiation as the same control surface. On a domain controller, those are different trust decisions, and only outbound NTLMv1 creates the coercion and relay path that matters. Practitioners should stop classifying level 2 as an acceptable middle ground for privileged infrastructure.
A question worth separating out:
Q: Should teams keep level 2 for legacy apps or move to level 3 on domain controllers?
A: Teams should move domain controllers to level 3 when legacy inbound compatibility must remain. Level 3 preserves that compatibility while removing the outbound NTLMv1 path, which is the part that creates the attack surface attackers actually exploit.
👉 Read our full editorial: LAN Manager authentication level 2 leaves domain controllers exposed