v2.2.0

v2.2.0

Numbers you can trust

This release is about accuracy. Checked against real Windows 11 24H2 and Server
2025 machines, three domain controllers and Microsoft's own documentation, the
dashboard turned out to count some NTLM logons twice, to file some under the
wrong panel and the wrong cause, and to count some that never happened. All of
that is fixed, and the collector can now settle doubtful cases against the
domain controllers' own record.

Expect your NTLM figures to go down after upgrading. That is not NTLM
disappearing; it is double counting and phantom entries leaving the totals.

Checked against the domain controllers

Windows 11 24H2 and Server 2025 write an 8001 as soon as NTLM is considered
during negotiation — even when Kerberos does the logon in the end. On a machine
that also writes the enhanced event 4020, an 8001 without a 4020 partner is
therefore doubtful.

The agent now collects 4776 on domain controllers: the DC's record of every
NTLM validation of a domain account. The collector checks each doubtful 8001
against it:

• A DC validated that account from that machine within two minutes → it was
  real NTLM after all and is counted.
• No DC validated that account from any machine, and every DC demonstrably
  covered that moment → shown as Phantom (checked by DC) and not counted.
• Anything in between — same account from another machine, a DC that has
  not delivered for that time yet, a local account no DC ever sees → stays
  unconfirmed: visible, not counted.

Nothing is hidden. The event list offers these entries behind a labelled filter
("n unconfirmed entries hidden, p of them shown to be phantoms by the DCs"), and
each one explains which DCs it was checked against.

The phantom verdict needs every DC. The machines panel now shows per DC
whether 4776 is arriving; one DC without them and no entry is called a phantom.

Counting each logon once

• 8001 and 4020 for the same logon are merged. Microsoft documents 4020 as a
  superset of 8001 and keeps writing both while the classic audit is enabled.
  They are paired per event — same machine, same target, within ten seconds —
  not per machine: an 8001 without a partner stays visible.
• 4022/4023 are incoming NTLM, logged on the server being accessed. They
  were filed as domain-controller events, which put member-server logons into
  the DC panel and counted a domain logon twice there.

The right cause

Windows Server 2025 writes Reason ID 10 (loopback) for several different causes,
with the correct text alongside. Windows 11 writes the same IP-address case as
ID 7. The dashboard now takes the cause from the text when it recognises it —
English and German — and falls back to the number otherwise. An IP address and
a DNS alias without an SPN no longer both show up as "loopback" with the wrong
remedy.

Agent

• 4776 on domain controllers (see above). Needs "Audit Credential
  Validation", which the Default Domain Controllers Policy already enables.
• Authentication-policy refusals were never collected. The agent asked the
  Protected Users channel for 100/101 and the policy channel for 301. Per
  Microsoft's event table 101 belongs to the policy channel and 301 does not
  exist. Now 100 (Protected Users) and 101 (authentication policy) come from
  the right channels. Both channels are disabled by default on DCs.
• 8001 records the account that actually authenticated. With explicit
  credentials (net use /user:…) that is the supplied account, not whoever ran
  the process.
• New application icon.

Dashboard

• Gold as the single accent colour for controls, matching the new brand mark.
  Red, amber and green keep their meaning and are used for data only.
• Crisper panel edges.
• New favicon.
• Faster: the classification above runs once per request instead of in
  every one of ~30 queries. A month of a busy domain went from 6.4 s to 1.7 s.

Project page and demo

• New project page at nobrac.github.io/NTLM-Analyzer,
  the live dashboard moved to /demo/.
• New brand mark across the icon, favicons, installer artwork, README and site.
• The demo shows the DC check with synthetic data.

Privacy

The screenshots carried the author's name in their image metadata. It is gone
from all images; the pixels are unchanged.

Known limits

• The phantom rule rests on field observations, not on Microsoft
  documentation: Microsoft does not document when exactly 8001 and 4020 are
  written. The DC check turns it into evidence per entry, which is why doubtful
  entries are settled rather than assumed.
• On machines without 4020 (before Windows 11 24H2 / Server 2025) phantom 8001s
  cannot be told apart and are counted.
• NTLMv1 against member servers older than Server 2025 is only visible where
  4624 is collected, which the agent currently does on DCs only.

Upgrading

1. Collector: replace ntlm-collector.py, restart, hard-refresh (Ctrl+F5).
   Existing data is corrected on first start — 4022/4023, reason IDs, pairing.
   No manual migration.
2. Agent — domain controllers first. Until every DC runs 2.2.0 nothing is
   called a phantom; everything doubtful stays unconfirmed, nothing breaks.
   The machines panel shows when all DCs deliver 4776.
3. Agent — everywhere else at your own pace. The MSI upgrades 2.1.x in
   place and keeps the configuration.
4. Retention: 4776 adds a row per NTLM validation domain-wide. If you run
   without --retention-days, consider setting it now.

Wire protocol compatible: 2.1.x agents keep working against the new collector,
and the collector corrects what they send.