topic Re: Problems Removing NTLM in General Topics

Problems Removing NTLM

jvillar — Fri, 29 Nov 2024 12:47:16 GMT

I'm going to repose the question regarding removing NTLMv1 in the domain since the posts I've seen are from 2021,
The Checkpoint version is 81.20.

When I proceeded to disable the use of NTLM in the domain I found two problems:
1) Firewalls lose connection to the DC
2) Remote access to internal computers by RDP using the Mobile Access module gives an error when validating the user.
Unchecking the obligation to only use connections with network-level authentication works.
I haven't tried to include equipment as an exception in the DC GPOs yet.
At this crossroads, will it be better to remove the use of NTLMv1 and use the indicated exceptions or not to remove NTLMv1?

Any ideas?

Best Regards

Re: Problems Removing NTLM

Lesley — Fri, 29 Nov 2024 14:40:23 GMT

This will help maybe to move to ntlm2

https://support.checkpoint.com/results/sk/sk165690

Do you use IDC collectors? They support also Kerberos which I would recommend

Re: Problems Removing NTLM

jvillar — Tue, 03 Dec 2024 06:35:33 GMT

The link is broken.

Re: Problems Removing NTLM

PhoneBoy — Tue, 03 Dec 2024 14:01:01 GMT

The link works, but you have to be logged into SupportCenter and be associated with an account with an active support agreement.

In any case, the link says that you need to change the policy on the Domain Controller to “Send NTLMv2 response only. Refuse LM & NTLM”