GPO Settings NTLM

[well 10]

As NTLM is vulnerable it is best to disable it. However is the option 1 (DC Setting) below as secure as the option 2 (Local Server Setting)?

I would like to go with option 1 because of the possible exception list but I am not sure if it gives the same security level as option 2? 

 

Any Idea? 

 

1) Restrict NTLM: NTLM authentication in this domain -> Deny for domain accounts to domain servers (Allow exception list) 

2) Network security: Restrict NTLM: Incoming NTLM traffic -> Deny all domain accounts

 

Thanks for any help. 

[theonlybrand 0]

Hi, Microsoft recommends to set the following item

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network security\LAN Manager authentication level
to the following value: Send NTLMv2 response only. Refuse LM & NTLM