> For the complete documentation index, see [llms.txt](https://www.netexec.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.netexec.wiki/smb-protocol/enumeration/enumerate-ntlmv1.md).

# Enumerate NTLMv1

{% hint style="warning" %}
You need at least local admin privilege on the remote target, use option **--local-auth** if your user is a local account
{% endhint %}

Enumerate the LmCompatibilityLevel on the remote target via the remote registry:

```bash
nxc smb <ip> -u user -p password -M ntlmv1
SMB         <ip>   445    <FQDN>            [*] Windows 10 / Server 2019 Build 17763 x64 (name:<FQDN>) (domain:<FQDN>) (signing:False) (SMBv1:None)
SMB         <ip>   445    <FQDN>            [+] <FQDN>\user:password (Pwn3d!)
NTLMV1      <ip>   445    <FQDN>            NTLMv1 allowed on: <ip> - LmCompatibilityLevel = 2
```

Outgoing NTLMv1 connections are enabled when the target’s LmCompatibilityLevel is lower than 3.

{% embed url="<https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level>" %}