eventid4024

Event ID 4024 is a new NTLM audit event introduced by Microsoft for Windows 11 24H2 and Windows Server 2025. It is part of a phased rollout to block NTLMv1-derived credentials, starting with auditing and later enforcing the block via a registry key called BlockNtlmv1SSO. This event helps administrators detect NTLMv1 usage in their environment before enforcement begins. The change affects both managed and unmanaged devices, with a default enforce posture expected by October 2026. Understanding Event ID 4024 is crucial for IT professionals preparing for this security update.