PowerShell module to audit NTLM authentication events from Windows Security and NTLM Operational logs. Filters by NTLMv1/v2, failed logons, privileged sessions (4672), date ranges, and null sessions. Validates NTLM audit GPO settings. Targets localhost, remote servers, domain controllers, or an entire AD forest.

Windows SMB signing and security audit toolkit — SMB signing status, encryption, dialect negotiation, and relay attack defense

Sends an unauthenticated NTLM type-1 (negotiate) message to the NDES SCEP administration endpoint and inspects the server's NTLM type-2 (challenge) response. When NTLM is enabled, the type-2 challenge leaks sensitive host and domain details in its TargetInfo block, including the server's NetBIOS and DNS computer names, the NetBIOS and DNS domain na... More info