Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I run a AD server with Windows 2008, I have clients running XP and Windows 7, now I've decided to enforce Lan Manager authentication by refusing LM & NTLMv1 encryption methood, would it be risky? (I mean incompatibility)

And was LM hashes persistent or one-time storage? If it's persistent, would it be converted automatically (or with user interaction)?

share|improve this question
up vote 3 down vote accepted

Your question is pretty strangely worded, but it sounds like what you actually want to do is disable LM and NTLMv1. If this is the case, I'd say you're probably fine and that's a reasonable thing to do, leaving you with NTLMv2 and Kerberos.

NTLMv2 has been supported since NT4 SP2/2000.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.