Exam 70-744 topic 1 question 140 discussion

NTLM\Operational

Only Domain Controllers Application and services logs\Microsoft\Windows\NTLM\Operational

Correct Answer is: Only Domain Controllers Applications and Services Log\Microsoft\Windows\NTLM\Operational Explanation: All authentication happens at the Domain Controller. You need to audit all of your Domain Controllers to get these events. The computers log authentication requests, but the actual authentication success/failure events are logged at the DC, along with information on who/what made the request.

Agree - Only Domain Controllers Application and services logs\Microsoft\Windows\NTLM\Operational

Computers on which to review the event logs: Only client computers Event logs to review: Applications and Services Logs\Microsoft\Windows\NTLM\Operational Do not confuse this with event ID 4776 recorded on domain controller's security event log!!! This question asks for implementing NTLM auditing when domain clients is connecting to member servers! See below for further information. https://docs.microsoft.com/en-us/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain Via lab testing, most of the NTLM audit logs are created on Windows 10 clients, except that you use Windows Server 2016 OS as clients (but this is unusual)