NTLM deprecation timeline: Microsoft's three phases and how to audit

Microsoft has not announced an NTLM shutdown date. Its plan, published on January 30, 2026, has three phases: audit tooling, replacements for the common fallback cases in the second half of 2026, and then network NTLM switched off by default in a future Windows release. To prepare, turn on the NTLM audit policies now and work through what they log.

The plan comes from a Windows IT Pro blog post published at the end of January 2026, and BleepingComputer's coverage summarises it. NTLM authentication was already declared deprecated in July 2024, but the protocol is still in Windows and still used by many environments without anyone noticing.

The NTLM deprecation timeline in three phases

Phase 1: auditing

Microsoft describes the first phase as better tooling to find where NTLM is still used. Enhanced auditing is available in Windows 11 24H2 and Windows Server 2025. The older Restrict NTLM audit policies, which exist since Windows 7 and Server 2008 R2, are still the documented starting point and work on current Windows versions.

Phase 2: replacements for common fallbacks (second half of 2026)

This phase adds two features that remove typical reasons for falling back to NTLM: IAKerb, which lets a client use Kerberos through a server when it cannot reach a domain controller directly, and a Local Key Distribution Center for local accounts. Microsoft scheduled them for the second half of 2026. Microsoft's announcement does not say that either feature is available on every supported build, so check the release notes for the Windows versions you run before relying on them.

Phase 3: network NTLM off by default (no date)

Microsoft says network NTLM will be disabled by default in the next major Windows Server release and associated client versions. No release date or version number was given in the January 2026 announcement. The protocol stays in the operating system, and administrators can turn it back on by policy. So the practical meaning of "deprecation" is a changed default, not removal.

What has already changed

• NTLM is deprecated since July 2024, which means no new development, not removal.
• NTLMv1 is documented by Microsoft as removed in Windows 11 24H2 and Windows Server 2025 (this is not in the January blog post, so confirm on Microsoft Learn for your build); remaining NTLM traffic there should be NTLMv2.
• Per the January 2026 plan, network NTLM is not yet disabled by default; check current release notes for anything newer.

Why NTLM still shows up in your environment

Kerberos is the preferred protocol in Active Directory, but Windows falls back to NTLM when Kerberos cannot work. Microsoft's own guidance lists the usual causes:

• Applications that connect by IP address instead of a DNS name or NetBIOS name.
• Services with missing or wrong service principal names (SPNs).
• Applications with legacy code that only implements NTLM, or that allow several security providers.
• Local accounts and workgroup machines, where NTLM is the supported method.

In practice, old NAS devices, printers, scanners and line-of-business servers are frequent sources. If you have already cleaned up RC4 in Kerberos, the same inventory work helps here; our guide to finding and fixing Kerberos RC4 usage covers that side.

How to audit NTLM usage with Group Policy

Every NTLM restriction policy has a matching audit setting, so you can log first and block later. All of these are under Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options. The details below follow Microsoft's guide to auditing NTLM traffic.

1. Clients and member servers: set Network security: Restrict NTLM: Audit Incoming NTLM Traffic to audit domain accounts or all accounts. This logs NTLM requests that arrive at the machine.
2. Clients and servers: set Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Audit all. This logs where each machine sends NTLM.
3. Domain controllers: set Network security: Restrict NTLM: Audit NTLM authentication in this domain. With Enable all it logs every incoming NTLM request to that domain controller, and it does not block anything, according to Microsoft's policy reference.

None of these need a restart. Apply them through a Group Policy Object scoped first to a pilot group, then widen. Watch the log size, because a busy domain controller can write a lot of events.

Where the events land and what the IDs mean

Audit and block events are written to the NTLM operational log: Applications and Services Logs, Microsoft, Windows, NTLM, Operational. There are no Security audit policies for this output. Following the Microsoft guide to viewing these events, trace one authentication across three machines:

• Event 8004 on the domain controller: shows the user, domain, workstation and the secure channel name, meaning the member server the client talked to.
• Event 8003 on that member server: shows the incoming request with the PID of the calling process.
• Event 8001 on the client: shows the target server name or IP address, the user, and the name of the client process that sent NTLM.
• Event 8002: also logged on remote and member servers when the outgoing-traffic audit is on, according to the same guide.

If the target in event 8001 is an IP address or a name that is not NetBIOS or FQDN, Kerberos will not be used. That single check explains many findings. When the PID is 4, the request came through SMB in kernel mode, and you need a tool such as Process Monitor on the client to find the real application.

Microsoft's 2026 plan also mentions enhanced auditing in Windows 11 24H2 and Server 2025. The announcement does not list event IDs for it, so check the current Learn documentation for your build rather than assuming the 800x IDs cover everything.

Security log fields

The Security log helps too. In logon events (4624), the Authentication Package field shows NTLM when NTLM was used, and Package Name (NTLM only) shows NTLM V1 or NTLM V2. Searching for the phrase "Authentication Package" in Event Viewer is Microsoft's suggested way to find these. Event 4776 records NTLM credential validation on domain controllers.

Fixing what the audit finds

• Replace IP addresses with FQDNs in connection strings, mapped drives and scripts.
• Register missing SPNs for services that run under a service account.
• Update or replace devices and applications that only speak NTLM; where that is not possible, document an exception.
• Use the exception policies, Add server exceptions in this domain and Add remote server exceptions, to allow NTLM to named servers while you restrict the rest.

Microsoft says the analysis can take months in a large environment. Expect several audit cycles before blocking anything.

Blocking NTLM after the audit

Once the logs are quiet, move from audit to deny in stages. On a member server, Restrict NTLM: Incoming NTLM traffic can deny domain accounts or all accounts. On domain controllers, Restrict NTLM: NTLM authentication in this domain has several deny levels. Microsoft warns that enabling these without prior auditing could make many authentication requests fail. Start with one server group, keep the audit policy on, and have a rollback plan.

For wider context on Windows security changes with deadlines, see our Security coverage, the vulnerabilities section and the Patch Tuesday calendar, which helps schedule policy changes around update cycles.

Frequently asked questions

When will NTLM be disabled in Windows?

Microsoft has not given a date. In its January 2026 announcement it said network NTLM will be off by default in the next major Windows Server release and matching client versions, and administrators will be able to re-enable it by policy.

Is NTLM removed from Windows 11 and Windows Server 2025?

No. NTLM is still present in both; Microsoft's documentation lists only NTLMv1 as removed. The January 2026 plan describes enhanced auditing in these releases to help you find remaining NTLM use.

Which event IDs show NTLM usage?

In the NTLM operational log, events 8001 (outgoing, on the client), 8002 and 8003 (incoming, on servers) and 8004 (on the domain controller) record NTLM activity once the audit policies are on. Security log events 4624 and 4776 add authentication package details.

Will disabling NTLM break my network?

It can, if applications still rely on it, typically through IP-address access, missing SPNs or old devices. That is why Microsoft recommends auditing first and blocking in stages with an exception list.

Do I need a restart to enable NTLM auditing?

No. Microsoft's policy documentation says changes take effect without a restart once saved locally or distributed through Group Policy.