NTLM

NTLM Event ID 8003: Domain server authentication audit

NTLM server blocked in the domain audit: Audit NTLM authentication in this domainNTLM event 8003 logs NTLM authentication of a domain account received by this server: user, domain, client workstation, logon type and process. Audit only.

8003

Event ID: 8003
Channel: Microsoft-Windows-NTLM/Operational
Provider: Microsoft-Windows-NTLM
Log file: Microsoft-Windows-NTLM%4Operational.evtx
Category: NTLM
Default logging: Needs configuration

What event 8003 means

Event 8003 is written on the server that received NTLM authentication for a domain account, describing a request that would be blocked if NTLM were restricted in the domain. Nothing is blocked; it is an audit record.

Unlike 8002, it names the authenticating account and its source: UserName, DomainName and Workstation (the client computer name as supplied in the NTLM exchange), along with the server-side ProcessName, CallerPID, LogonType and InProc.

Microsoft's NTLM auditing walkthrough shows 8003 on a member server at the same moment as 8004 on the domain controller and 8001 on the client, which lets you follow one NTLM authentication across all three machines. For SMB access, CallerPID is 4 because the server side runs in kernel mode.

When it is logged

Audit policy / configuration

NTLM auditing through Security Options > Network security: Restrict NTLM policies (Audit Incoming NTLM Traffic on servers, Audit NTLM authentication in this domain on domain controllers). Events go to Applications and Services Logs > Microsoft > Windows > NTLM > Operational.

The message refers to the "Restrict NTLM: NTLM authentication in this domain" policy, which is the blocking policy this audit mirrors.

Key fields

Field	What it tells you
UserName	Account that authenticated with NTLM.
DomainName	Domain of the account.
Workstation	Client computer name supplied in the NTLM exchange. Client-controlled, so it can be spoofed or empty.
CallerPID	PID of the server process that handled the request; `4` for SMB.
ProcessName	Server process that handled the request; empty for kernel-mode SMB.
LogonType	Logon type of the resulting session, typically `3` (network).
InProc	Whether the authentication was processed in-process (`true` / `false`).
MechanismOID	Negotiation mechanism OID, often `(NULL)`.

Common benign sources

Users accessing file shares by IP address or through aliases without SPNs.
Legacy line-of-business applications that only support NTLM.
Devices outside the domain authenticating with domain credentials.

What attackers do that produces it

Pass-the-hash or NTLM relay against this server using a domain account — visible here with the claimed Workstation.
A privileged account (Domain Admins, service accounts) authenticating with NTLM from a workstation where it is not normally used.

Investigation tips

Group by UserName and Workstation to find accounts and clients still using NTLM, and flag new or unexpected pairs.
Correlate with 4624 on this server (LogonType 3, NTLM) to get the source IP, and with 8004 and 4776 on the domain controller.
Compare Workstation with the source IP's real host name; a mismatch can indicate a tool supplying a fake name.

MITRE ATT&CK techniques

Technique	Tactics
T1550.002 Use Alternate Authentication Material: Pass the Hash	Lateral Movement
T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay	Credential Access, Collection

MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.

Sigma rules for this event

No bundled SigmaHQ rule targets this event ID specifically. Rules on related events may still cover the activity.

Run these rules on your logs

Drop a .evtx file into the viewer: all 2,395 bundled SigmaHQ rules run locally in your browser. Nothing is uploaded.

Open the viewer Filter a log on event 8003