Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions
No content change seen yet. Watched since 12 Oct 19:19 UTC, last read today 08:48 UTC, next check 24 Oct 08:48 UTC.
Read the Microsoft source · Link to this observation · My radar
Timeline
From the capture of today 08:48 UTC- 2 dates
- 6 undated sections
- 2 with conditions
- 1 recorded change
- Audit / monitor11 Jul 2025 Now: Events or warnings only; nothing is blocked
- Audit / monitorafter 13 Oct 2026 Published timing is qualified; effectiveness is not confirmed.
- 15 months agoAudit / monitor
Original publish date: July 11, 2025 KB ID: 5064479…
- 10 days agoafterstartingon or afterAudit / monitor · unconfirmed
- IntroductionMilestone
KB5126655KB5126651 - Deployment informationMilestone
Requirements, exceptions and scope
Relationship between new and existing NTLM events…
This article provides an overview of upcoming enhancements to…
Microsoft's revision log on this page · 1 entry
Dates from the page's own change log or history section. They describe earlier edits, not upcoming policy.
- October 13, 2026 · after October 13, 2026Change logMilestone
Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.
How this timeline changed
Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.
Observed history and review priority
Captured today 08:48 UTC; extracted today 08:48 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.
Review priority. Extracted assertions require review · Applicability or exceptions require review
0 date changes and 0 condition changes across 0 compared revisions. Suggested check interval: 24 hours.
Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.
Related public evidence
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Windows Kerberos Elevation of Privilege Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
- Public source · 13 Oct 2026Windows Kerberos Elevation of Privilege Vulnerability
What changed
First observed 23 Oct 2026No field changes are shown for this selection.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.