Forum Discussion

Former Employee

Sep 24, 2019

Enriched NTLM authentication data using Windows Event 8004

Have you previously experienced NTLM authentications activities that came from unknown devices, such as Workstation or MSTSC? Would you like to discover the actual server being accessed inside the ne...

truekonrads

Brass Contributor

Mar 19, 2020

Tali Ashhi - we enabled NTLM auditing however no 8004 events are generated despite 4776s being generated. We verified that NTLM auditing is enabled using gpresult.

Any tips to debug?

LoicMichel

Copper Contributor

Oct 30, 2020

Hi, did you ever find a solution to events 8004 not being generated? I'm in the same situation.
Regards
Loic