8001｜NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.

這個指令做什麼？

事件調查：NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked.。固定提供者 Microsoft-Windows-NTLM；事件 ID 8001。讀取事件證據，不代表偵測到入侵；需結合上下文判讀。 NTLM client blocked audit: Audit outgoing NTLM authentication traffic that would be blocked. Target server: %1 Supplied user: %2 Supplied domain: %3 PID of client process: %4 Name of client process: %5 LUID of client process: %6 User identity of client process: %7 Domain name of user identity of client process: %8 Mechanism OID: %9 Audit the NTLM authentication requests from this computer that would be blocked by the target server %1 if the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers is set to Deny all. If you want all servers to accept NTLM authentication requests from this computer, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Allow all. If you want only the target server %1 to accept NTLM authentication requests from this computer, set the security policy Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all, and then set the security policy Network Security: Restrict NTLM: Add remote server exceptions and list the target server %1 as an exception to use NTLM authentication.