NTLM authentication denied because user is in Protected Users group (which blocks NTLM).
Protected Users group blocks NTLM, DES, RC4, and unconstrained delegation. This event means Protected Users is working correctly. Pass-the-Hash attacks fail for Protected Users members.
Expected for Protected Users members. If occurring for accounts NOT in Protected Users, investigate.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4822 // NTLM authentication failed because the account was a member of the Protected Users group
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4822
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# NTLM authentication failed because the account was a member of the Protected Users group — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`NTLM authentication failed because the account was a member of the Protected Users group. NTLM authentication denied because user is in Protected Users group (which blocks NTLM).
Event 4822 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Expected for Protected Users members. If occurring for accounts NOT in Protected Users, investigate.