Tracking Domain Clients using NTLM Authentication

Hi,

We have a requirement with one of our client where they have configured Domain Controllers Policy "LAN Manager Authentication level" to Send LM and NTLM - use NTLM v2 if security is negotiated

They have a requirement to change that setting to "Use NTLM V2 Response only / Refuse LM.

But before changing the setting they want to analyse who all are still using LM/NTLM protocols for authentication. Is there a way they can find from DC Security logs or from any other mean as to what all clients are still using LM or NTLM protocols for authentication.