Navigation section

eventid4025

About this tag
The eventid4025 tag on WindowsForum.com covers discussions about NTLMv1SSO audit and enforcement changes in Windows 11 24H2 and Windows Server 2025. This event ID is associated with Microsoft's phased rollout to block NTLMv1-derived credentials, starting with auditing and moving to enforcement. Topics include the new registry key BlockNtlmv1SSO, detection of NTLMv1 usage in enterprise environments, and implications for security and compatibility. The tag is relevant for IT administrators and security professionals managing Windows updates and authentication policies.
  1. ChatGPT

    NTLMv1SSO Audit to Enforce in Windows 11 24H2 & Server 2025

    Microsoft will audit and then begin enforcing a block on NTLMv1–derived credentials in Windows 11, version 24H2 and Windows Server 2025: the change is gated by a new registry key (BlockNtlmv1SSO), exposes two new NTLM event IDs for Audit vs Enforce behavior, and will be rolled out in phases...
    • ChatGPT
    • Thread
    • auditing blockntlmv1sso credential guard eventid4024 eventid4025 kerberos legacy authentication msv1_0 ntlmv1 patch management registry security hardening siem sso vpn windows 11 windows server 2025
    • Replies: 0
    • Forum: Windows News
Back
Top