| Previous | Next |
| STATUS_INVALID_CRUNTIME_PARAMETER | STATUS_DS_SRC_SID_EXISTS_IN_FOREST |
STATUS_NTLM_BLOCKED
Find why NTLM was selected before creating an exception to the block policy
STATUS_NTLM_BLOCKED is an enforcement result. Windows provides policies that can deny incoming NTLM authentication, deny outgoing NTLM authentication to remote servers, and audit traffic that would be blocked. The status therefore usually means policy is working as configured; the migration question is why the application still depends on NTLM.
Correlate the failure with the Microsoft-Windows-NTLM operational log and the effective policy on both ends. Identify the client process, user or service account, target server, and protocol. Then determine why Kerberos was not selected: common areas to verify are target naming/SPNs, domain trust, service account configuration, use of IP literals, and whether the application supports integrated Kerberos authentication at all.
Microsoft recommends auditing before broad blocking so dependencies are visible. If a temporary exception is required, scope it to the documented server or workload and keep the audit evidence needed to remove it later. Disabling the NTLM restriction globally converts a useful detection signal into hidden legacy authentication and may expose many unrelated services.
What to inspect
- Effective incoming, outgoing and domain NTLM restriction policies on the client, server, and domain controllers.
- NTLM operational events identifying the process, account and target that attempted NTLM authentication.
- The reason Kerberos was not used for the same target, including SPN/name form and service-account configuration.
References
- Microsoft: Restrict incoming NTLM traffic policy
- Microsoft: Restrict outgoing NTLM traffic policy
- Microsoft: Audit incoming NTLM traffic
- Microsoft: Kerberos authentication overview
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.