In this demonstration, we will work with gentlemen.
You will look at how you can audit Intel and usage in the server environment.
Following this, you will configure Intel M security to make sure that Intel in version two is enforced
when it comes to working with Intel Elm.
It's important to note that many old devices in your environment could still use those old authentication
protocols.
Some of those devices might support Intel ARM Version two.
However, it might only support it after you actually configure it.
So a word of caution don't simply disable intel and version one without knowing which devices are using
it.
And how would you know which devices are using it?
Well, the first step is to perform auditing.
When you enable and tlm auditing, you have the ability to look at your audit logs and look for event
ID 4624.
You'll see a sample of event ID 4624 on your screen.
In the sample, you'll notice that the log on type is logged on type three.
This means that the user computer has logged on to the destination computer from the network.
The next piece that's highlighted is the authentication package.
Here we can see that anti alarm was used as the authentication method.
The next section to look at is the package name and TLM only.
In this example you'll notice that in tlm version two was used.
However, if it showed L, M, or NTL and V one, then you know that either the land manager or in tlm
version one was used.
Now you'll go ahead and enable the deepest level of intial auditing possible.
And to do this, you're going to navigate to group policy management.
And since we want to enable this in tlm auditing across the domain, you will go ahead and edit the
default domain policy.
And within the default domain policy, you're going to navigate to policies, slash windows settings,
slash security settings, slash local policies, slash security options.
Within security options, there are three group policy settings that we are going to look at.
The first one is the ordered incoming intel and traffic.
Then we will look at Audit Elm authentication in this domain and we will look at outgoing intel traffic
to remote servers.
So let's start with the first one audit incoming intel m traffic.
In this setting, you have three possible values to define the first being disable, which of course
disables the policy.
The second one, which is enable auditing for domain accounts.
When this is enabled, events will be logged for Intel and pass through authentication requests only.
The next setting, which is enable auditing for all accounts, will log events for all anti alarm authentication
requests.
Since we want to enable the deepest level of TLM auditing to ensure that we don't break any collectivity.
We will select enable auditing for all accounts.
You'll click on okay.
And now you'll move on to the next setting, which is audit and TLM authentication in this domain.
And within this setting we're going to enable all since you need to ensure that you are auditing all
and tlm authentication.
You'll click on okay, now let's move on to the next setting which is outgoing in tlm traffic to remote
servers.
And this group policy allows you to deny or audit outgoing inter-island traffic from a computer running
Windows seven or later to any remote server that runs a Windows operating system.
So you will click on okay.
And now you have successfully enabled nt tlm auditing.
Now in a real world scenario, you would leave this group policy active for some time, perform auditing
on the event logs, and ensure that you have a clear picture of what devices in your organization uses
anti tlm version one once you have isolated the ones that use in tlm version one and if they cannot
be upgraded, you can then use a different group policy to specifically target those devices that can
work within TLM version two.
So once you have audited your log on events and found that there are no devices that are using old authentication
protocols, you are then ready to enforce in TLM Version two in order to enforce in tlm version two,
you need to modify one policy which is network security LAN manager authentication level.
This setting has six levels and they are counted from zero.
So at zero one, two, three, four, five.
So when this is hardcoded on the registry, you would see a registry security level starting from zero
and zero being sent Elm and Intel and responses.
So what do each of these settings mean?
While the first one is obvious in which you are only hard coding your authentication level to work with
LAN manager and into Elm, the second one enables the use of Intel and V two session security only if
it's negotiated.
The next one drops LAN manager and only uses Intel M version one.
The one after that starts to introduce Intel and version two.
However, the domain controller will still accept Elm and Intel in version one authentication.
The next setting starts to completely refuse LAN manager and the most secure settings starts to refuse
LAN Manager and Intel Version one Best practices dictate that you should start with a security level
of three, so that would be zero one, two and three.
So the authentication level to start with as you start to enforce in TLM version two is the setting
which is send Intel and V two response only.
What this does is it enables Intel and V two as default, but still allows a fallback to LAN manager
in Intel m version one.
Once you configure this, you'll notice that there is a warning which will take you to a microsoft article
which dictates the possible impact of configuring this setting.
Since you need to ensure that Intel and V two is starting to be used as a default, you will accept
this change and allow the setting to be configured.
The next step from here would be to perform auditing again, and the reason for performing additional
auditing is to see which devices are still using LAN manager and eliminate them from the environment.
If there are no devices that are using LAN manager anymore, you can then move to the next level of
four and perform auditing again and pretty much repeat the same process until you get to the most secure
level of five.
And that is when the system refuses.
Land Manager and anti elm.
So what if you wanted to remove anti Elm authentication completely?
Well, the two settings that are defined here under restrict into elm incoming into elm traffic and
restrict into Elm.
And TLM authentication in this domain is what you could configure to completely stop into Elm.
But again, a word of caution is to make sure that you have audited the environment to ensure that your
devices can support another authentication protocol such as Kerberos instead of 90 Elm.
These settings are extremely powerful and if they are configured incorrectly, you could pretty much
break your environment and have endless issues with devices that do not authenticate.
So best practice is to make sure that you perform a deep level of auditing to ensure that you have a
clear picture of any impacted devices as you define the settings for restricting into ELM.