Find out who still uses NTLM in your Active Directory, so you can retire it for Kerberos.

A Windows agent and a central collector with a web dashboard. It shows which users, computers and programs still authenticate over NTLM, which of them fell back from Kerberos and can be fixed, and whether usage is going down. The collector is one Python file with no dependencies; the agent is one self-installing EXE.

         

Live demo (the real dashboard on synthetic lab data) · Project page

Note

Most of the code was written by Claude (Anthropic) in a pair-programming workflow. I defined the requirements and reviewed and tested everything in a real AD environment. Review it before production use, as you would any code you did not write.

Screenshots

More screenshots

Most-used targets

When NTLM happens (the bright cell on Sunday 05:00 is the backup job nobody remembers)

Why NTLM was used, with a remedy per cause

Who uses NTLM and where to, from the domain controller

Services accepting NTLM

NTLMv1 SSO, which stops working in October 2026

Already on Kerberos, including weak-encryption findings

Machines and auditing status

Recent events

Event detail

Ready to switch off, per machine and direction

NTLMv1 by user

Failed NTLM attempts

SPN check with the setspn command to fix each finding

Accounts using NTLM

Account and machine detail

Machines without an agent, seen only through the domain controllers

Search (Ctrl+K)

Status report

Light theme

Quick start

1. Enable auditing (GPO)

Nothing is collected without it, and events are only written from the moment auditing is on. The settings are under Computer Configuration → Policies → Windows Settings → Security Settings:

Where	Setting	Value
All machines · Local Policies → Security Options	Restrict NTLM: Outgoing NTLM traffic to remote servers	Audit all (not Deny all)
All machines · Local Policies → Security Options	Restrict NTLM: Audit Incoming NTLM Traffic	Enable auditing for domain accounts
DCs · Local Policies → Security Options	Restrict NTLM: Audit NTLM authentication in this domain	Enable all
DCs and member servers · Advanced Audit Policy → Logon/Logoff	Audit Logon	Success and Failure. Before Server 2025, Success is the only source of the NTLMv1/v2 distinction (on by default on Windows Server); Failure shows failed NTLM logons.
DCs · Advanced Audit Policy → Account Logon (optional)	Audit Kerberos Service Ticket Operations	Success and Failure. Failures feed the Why NTLM? panel.

Then run gpupdate /force. The badges in the dashboard's Machines & auditing status panel turn green once the policy has reached each machine.

2. Install the collector (Linux)

sudo ./install.sh

The script detects Debian or RHEL, creates a hardened systemd service, keeps the password and API key off the command line and prints the agent install command. To start it by hand: python3 ntlm-collector.py --help (no pip packages needed).

3. Install the agent (each Windows machine, elevated)

Download ntlm-agent.msi from the latest release and double-click it, or install unattended:

msiexec /i ntlm-agent.msi /qn COLLECTORURL=https://collector.example.local:8443

With the bare EXE: ntlm-agent.exe install --collector-url https://… --api-key * (prompts for the key). It copies itself to Program Files, secures its data folder and registers and starts the service. The URL must be https://; plain http:// needs --allow-http (MSI: ALLOWHTTP=1).

4. Open the dashboard

Go to https://collector.example.local:8443/. The Machines panel should list every agent with a green heartbeat.

Good to know

• The dashboard makes no external requests, uses a default-src 'none' CSP, requires login on every endpoint and has XSS-tested rendering. Run the collector with TLS (--cert/--tlskey) and --password; use plain HTTP for testing only.
• The agent can run as a gMSA instead of LocalSystem. The agent README covers that, the MSI properties and handling the API key in unattended rollouts.
• The enhanced 40xx events (process names for NTLM) exist only on Windows 11 24H2 and Server 2025. Older systems deliver everything else, and the dashboard tells you when data is missing for that reason.
• A domain controller running agent 2.4 or later looks up in AD each service name that clients fell back to NTLM for (read-only, no extra rights). The dashboard lists names that are missing, duplicated or registered only for the real server behind an alias, with the setspn command to fix them. The tool never changes AD.
• The Report button produces a printable status page (save as PDF from the browser) with trend, progress, risks and next steps, in German or English.
• All CLI options: python3 ntlm-collector.py --help and ntlm-agent.exe --help.
• The operations guide has component details, every CLI flag, troubleshooting and the checklist for turning NTLM off.
• Changes per version: CHANGELOG and Releases.

License

GPL-3.0, see LICENSE.