A Windows agent plus a central collector with a web dashboard: which users, computers and programs still authenticate over NTLM, which of them fell back from Kerberos (and can be fixed), and whether usage is trending toward zero. The collector is one Python file with no dependencies; the agent is one self-installing EXE.
▶ Live demo — the real dashboard on synthetic lab data. Charts, drill-downs, search, filters and the per-event detail view all work. · Project page — what it does and why.
Note
Built with AI assistance. Most of the code was written by Claude (Anthropic) in a pair-programming workflow; I defined requirements, reviewed and tested everything in a real AD environment. Review it before production use, as you would any code you did not write.
More screenshots — SPN check, accounts, failed attempts, ready to switch off, machine and account detail, status report, timing, causes, Kerberos side …
Most-used targets
When NTLM happens — the bright cell on Sunday 05:00 is the backup job nobody remembers
Why NTLM was used — each cause with its concrete remedy, each row clickable
Who uses NTLM — and where to (from the domain controller)
Services accepting NTLM — the receiving side
NTLMv1 SSO — breaks on its own in October 2026
Already on Kerberos — the safe side, including weak-encryption findings
Machines & auditing status — OS builds, audit badges, Oct 2026 readiness
Recent events — filterable, searchable, CSV export
Event detail — every raw field, with an explanation of the event ID
Ready to switch off — per machine and direction, with what would break
Insecure logons by user — NTLMv1, and where it cannot be seen
Failed NTLM attempts — reason in plain words, locked accounts, spraying
Kerberos configuration (SPN) — service names missing, registered twice or only under the real server name, with the setspn command
Accounts using NTLM — per account: version, machines, servers, failures, Kerberos
Account detail and machine detail — everything about one account or machine
Machines without an agent — seen only through the domain controllers
Search — Ctrl+K over machines, accounts, programs, targets and panels
Status report — to print or save as PDF; on screen it follows the dark theme
Light theme
Events are written from the moment auditing is on, not retroactively.
Under Computer Configuration → Policies → Windows Settings → Security Settings:
| Where | Setting | Value |
|---|---|---|
| All machines · Local Policies → Security Options | Restrict NTLM: Outgoing NTLM traffic to remote servers | Audit all — not Deny all |
| All machines · Local Policies → Security Options | Restrict NTLM: Audit Incoming NTLM Traffic | Enable auditing for domain accounts |
| DCs · Local Policies → Security Options | Restrict NTLM: Audit NTLM authentication in this domain | Enable all |
| DCs and member servers · Advanced Audit Policy → Logon/Logoff | Audit Logon | Success and Failure — Success is before Server 2025 the only source of the NTLMv1/v2 distinction (on by default on Windows Server); Failure shows failed NTLM logons |
| DCs · Advanced Audit Policy → Account Logon (optional) | Audit Kerberos Service Ticket Operations | Success and Failure — failures feed the Why NTLM? panel |
Then gpupdate /force. The dashboard's Machines & auditing status panel
turns its badges green once the policy has landed on each machine.
sudo ./install.shDetects Debian/RHEL, creates a hardened systemd service, keeps password and API
key out of the command line, and prints the finished agent install command.
(Manual start: python3 ntlm-collector.py --help — no pip packages needed.)
Download ntlm-agent.msi from the latest release and
double-click, or unattended:
msiexec /i ntlm-agent.msi /qn COLLECTORURL=https://collector.example.local:8443Or with the bare EXE: ntlm-agent.exe install --collector-url https://… --api-key *
(asks for the key) — copies itself to Program Files, secures its data folder,
registers and starts the service. The URL must be https://; plain http://
only with --allow-http (MSI: ALLOWHTTP=1).
https://collector.example.local:8443/ → the Machines panel should show
every agent with a green heartbeat.
- Security: the dashboard is a single page with zero external requests,
a
default-src 'none'CSP, login on every endpoint and XSS-tested rendering. Run the collector with TLS (--cert/--tlskey) and--password; plain HTTP is for testing only. - Least privilege: the agent can run as a gMSA instead of LocalSystem — see the agent README, which also covers the MSI properties and how to handle the API key in unattended rollouts.
- Enhanced 40xx events (process names for NTLM) exist on Windows 11 24H2 / Server 2025 only; older systems still deliver everything else, and the dashboard says so instead of showing empty panels.
- SPN check: a domain controller running agent 2.4 or later looks up in
AD every service name clients fell back to NTLM for — read-only, no extra
rights. The dashboard names what is missing, duplicated or registered only
for the real server name behind an alias, with the
setspncommand to fix it. The tool itself never changes AD. - Status report: the Report button turns the current state into a printable page (PDF from the browser) for everyone who does not open the dashboard — trend, progress, risks and next steps, in German or English.
- What changed in each version: CHANGELOG and the Releases page.
- All CLI options:
python3 ntlm-collector.py --helpandntlm-agent.exe --help. - Everything else — component details, every CLI flag, troubleshooting and the checklist for actually turning NTLM off — lives in the operations guide.
GPL-3.0 — see LICENSE.