improvements

[tecxx]

Which event id's are logged? 8004 ?

and why does it say Windows 10 in "Applies to" when this is a policy that is only effective on domain controllers?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: dbb8b947-6958-5295-2ca1-b8292dbfef99
• Version Independent ID: 01d43298-a48e-4531-b289-c44cadb305ab
• Content: Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) - Windows security
• Content Source: windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md
• Product: m365-security
• Technology: windows-sec
• GitHub Login: @Dansimp
• Microsoft Alias: dansimp