{"id":208580,"date":"2024-02-22T14:09:06","date_gmt":"2024-02-22T14:09:06","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/anleitung-ntlm-authentifizierung-powershell-einrichten\/"},"modified":"2024-03-04T18:41:26","modified_gmt":"2024-03-04T18:41:26","slug":"anleitung-ntlm-authentifizierung-powershell-einrichten","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/de\/script-hub\/anleitung-ntlm-authentifizierung-powershell-einrichten\/","title":{"rendered":"Festlegen der NTLM-Authentifizierung in Windows mit PowerShell"},"content":{"rendered":"

In einer sich st\u00e4ndig weiterentwickelnden Cybersecurity-Landschaft ist die Sicherung von Kommunikation und Datenaustausch von h\u00f6chster Bedeutung. Ein Protokoll, das in diesem Zusammenhang besonders diskutiert wird, ist NTLM (NT LAN Manager), das zur Authentifizierung von Benutzer:innen in Microsoft-Umgebungen verwendet wird. Mit den j\u00fcngsten Fortschritten und Bedenken hinsichtlich Sicherheit hat es eine Umstellung von \u00e4lteren NTLM-Versionen auf das sicherere NTLMv2 gegeben. Heute werden wir tief in ein PowerShell-Skript eintauchen, das dabei hilft, die NTLM-Authentifizierungs<\/strong>-Antworten zu verwalten, indem es den LmCompatibilityLevel in der Windows-Registrierung festlegt.<\/p>\n

Hintergrund<\/h2>\n

Urspr\u00fcnglich von Microsoft als Authentifizierungsprotokoll entwickelt, hat NTLM mehrere Aktualisierungen durchlaufen, um verschiedene Sicherheitsl\u00fccken anzugehen. Allerdings wurde mit dem Aufkommen sicherer Authentifizierungsmechanismen, insbesondere NTLMv2, deutlich, dass es notwendig wurde, \u00e4ltere Versionen einzuschr\u00e4nken oder zu deaktivieren. Dieses Skript unterst\u00fctzt IT-Profis und Managed Service Providers (MSPs)<\/a> dabei, diese Umstellung reibungslos zu vollziehen, ohne manuell durch komplexe Registrierungseinstellungen navigieren zu m\u00fcssen.<\/p>\n

Das Skript<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Set the LM and NTLMv1 authentication responses via LmCompatibilityLevel in the registry\r\n.DESCRIPTION\r\n    Set the LM and NTLMv1 authentication responses via LmCompatibilityLevel in the registry\r\n.EXAMPLE\r\n    No parameters needed.\r\n    Sets LAN Manager auth level to 5, \"Send NTLMv2 response only. Refuse LM & NTLM.\"\r\n.EXAMPLE\r\n     -LmCompatibilityLevel 5\r\n    Sets LAN Manager auth level to 5, \"Send NTLMv2 response only. Refuse LM & NTLM.\"\r\n.EXAMPLE\r\n     -LmCompatibilityLevel 3\r\n    Sets LAN Manager auth level to 3, \"Send NTLMv2 response only.\"\r\n    This is the default from Windows 7 and up.\r\n.EXAMPLE\r\n    PS C:> Disable-LmNtlmV1.ps1 -LmCompatibilityLevel 5\r\n    Sets LAN Manager auth level to 5, \"Send NTLMv2 response only. Refuse LM & NTLM.\"\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Reference chart: https:\/\/ss64.com\/nt\/syntax-ntlm.html\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n.COMPONENT\r\n    ProtocolSecurity\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [ValidateRange(0, 5)]\r\n    [int]\r\n    $LmCompatibilityLevel = 5\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator))\r\n        { Write-Output $true }\r\n        else\r\n        { Write-Output $false }\r\n    }\r\n    function Set-ItemProp {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet(\"DWord\", \"QWord\", \"String\", \"ExpandedString\", \"Binary\", \"MultiString\", \"Unknown\")]\r\n            $PropertyType = \"DWord\"\r\n        )\r\n        New-Item -Path $Path -Force -ErrorAction SilentlyContinue | Out-Null\r\n        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue)) {\r\n            Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false | Out-Null\r\n        }\r\n        else {\r\n            New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false | Out-Null\r\n        }\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    $Path = @(\r\n        \"HKLM:SYSTEMCurrentControlSetServicesLsa\"\r\n        \"HKLM:SYSTEMCurrentControlSetControlLSA\"\r\n    )\r\n    $Name = \"LmCompatibilityLevel\"\r\n    # $Value = $LmCompatibilityLevel\r\n    # Sets LmCompatibilityLevel to $LmCompatibilityLevel\r\n    try {\r\n        $Path | ForEach-Object {\r\n            Set-ItemProp -Path $_ -Name $Name -Value $LmCompatibilityLevel\r\n        }\r\n        \r\n    }\r\n    catch {\r\n        Write-Error $_\r\n        exit 1\r\n    }\r\n    $Path | ForEach-Object {\r\n        $Value = Get-ItemPropertyValue -Path $_ -Name $Name -ErrorAction SilentlyContinue\r\n        if ($null -eq $Value) {\r\n            Write-Host \"$_$Name set to: OS's default value(3).\"\r\n        }\r\n        else {\r\n            Write-Host \"$_$Name set to: $Value\"\r\n        }\r\n    }\r\n}\r\nend {}<\/pre>\n
 <\/p>\n\n
Zugriff auf \u00fcber 300 Skripte im NinjaOne Dojo<\/p>\n
Zugang erhalten<\/a><\/p>\n<\/div>\n
Detailansicht<\/h2>\n
Das Skript ist im Wesentlichen in drei Phasen unterteilt: begin<\/em>, process<\/em> und end<\/em>.<\/p>\n