New answers tagged ntlm
Greg's answer is alright, but your question specifically states that you want to check this from the client, not from the domain controller. So I'll take a crack at it. First way, enable Kerberos logging on your client: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters LogLevel DWORD 0x1 Once Kerberos logging is enabled, ...
One way would be to check the domain controller Security event log for Event Id 4264 (logon) events, where the AuthenticationPackageName is NTLM or Kerberos. You should also verify that your domain controllers have auditing enabled, and are capturing the required auditing events. You can create custom Event Viewer filters to make this easier, and filter ...
You can force your client to only use one or the other to ensure that you're using Kerberos (or NTLM if you prefer that for some reason). Microsoft has a guide which you may find helpful. It tells how to assess and restrict NTLM usage. Auditing and restricting NTLM usage guide
Top 50 recent answers are included