Quick answer: LmCompatibilityLevel is a Registry value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa that sets which LAN Manager and NTLM responses Windows sends and accepts. It runs from 0 (least secure) to 5 (most secure). When it isn’t set, current Windows versions behave like level 3, sending NTLMv2 only. Level 5 is the recommended setting, and you change it with the Group Policy Network security: LAN Manager authentication level or directly in the Registry.
Applies to: Windows 11, Windows 10 and Windows Server.
In this guide
What LmCompatibilityLevel does
When you open a shared folder, map a drive or sign in to a server that doesn’t use Kerberos, Windows can fall back to the older challenge-response protocols: LM, NTLM (also called NTLMv1) and NTLMv2. LM and NTLMv1 are weak and their responses can be cracked, so modern networks should use only NTLMv2, or Kerberos where possible.
LmCompatibilityLevel controls two things: which response types this PC sends when it connects to something, and, on domain controllers, which response types they accept.
The six levels
| Value | Policy option | What it means |
|---|---|---|
| 0 | Send LM & NTLM responses | Sends the weakest responses. Never use this today. |
| 1 | Send LM & NTLM – use NTLMv2 session security if negotiated | Still sends LM and NTLM. |
| 2 | Send NTLM response only | Stops LM, still sends NTLMv1. |
| 3 | Send NTLMv2 response only | Sends NTLMv2 only. This is how Windows behaves when the value isn’t set. |
| 4 | Send NTLMv2 response only. Refuse LM | Like 3, and domain controllers refuse LM. |
| 5 | Send NTLMv2 response only. Refuse LM & NTLM | Like 3, and domain controllers refuse both LM and NTLMv1. Recommended. |
Levels 4 and 5 only change what’s accepted on domain controllers. On a home PC that isn’t a domain controller, 3, 4 and 5 all make the PC send NTLMv2 only.
Check your current level
Open Command Prompt and run:
reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LmCompatibilityLevelIf you see ERROR: The system was unable to find the specified registry key or value, the value isn’t set and Windows uses its default (level 3). Otherwise the number at the end of the line, such as 0x5, is the level.
Change it with Group Policy
On Windows 11 or 10 Pro, Enterprise or Education:
- Press Windows + R, type
secpol.mscand press Enter. (You can also usegpedit.mscand go to Computer Configuration > Windows Settings > Security Settings.) - Go to Local Policies > Security Options.
- Double-click Network security: LAN Manager authentication level.
- Choose Send NTLMv2 response only. Refuse LM & NTLM and select OK.
In a domain, set it in a Group Policy Object instead, so every PC gets the same level. Our Group Policy Management Console guide shows how to install and use the console.
Change it in the Registry
On Windows Home, or for a quick change, open Command Prompt as administrator and run (use the level you want in place of 5):
reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LmCompatibilityLevel /t REG_DWORD /d 5 /fRestart the PC so every service picks it up. If a domain Group Policy also sets this option, the policy wins and overwrites your Registry change at the next refresh.
Old NAS or printer can’t connect
A common reason people search for this value is an old NAS, scanner-to-folder printer or Samba server that suddenly stops accepting connections, often with The specified network password is not correct or Windows cannot access. Older guides tell you to lower the level to 1 or 2. Try these first instead:
- Update the device’s firmware, or in its settings turn on NTLMv2 (sometimes labelled NTLMv2 only or SMB2/SMB3).
- Check that you’re using the right user name format, such as
NAS-NAME\username. - Work through the network checks in our 0x80070035 guide and map a network drive guide.
Lowering the level is a last resort. It weakens every connection the PC makes, and it may not help at all on new versions: Microsoft says NTLMv1 has been removed from Windows 11 version 24H2 and Windows Server 2025. If a device only supports LM or NTLMv1, the lasting fix is to update or replace it.
Related guides
- Windows cannot access a shared folder: fixes that work
- Error 0x80070035: the network path was not found
- How to map a network drive in Windows 10
- Group Policy Management Console in Windows 11
Official sources: for more detail, see these pages:
- Microsoft Learn: Network security: LAN Manager authentication level
- Microsoft Support: Changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025
Frequently asked questions
What is the default LmCompatibilityLevel?
The value usually isn’t present at all. In that case Windows 10, Windows 11 and current Windows Server versions behave as level 3, sending NTLMv2 responses only.
Is level 5 safe to set at home?
Yes for almost everyone. Modern NAS boxes, routers and Windows PCs all support NTLMv2. Only very old devices that know nothing newer than LM or NTLMv1 stop working.
Do I need to restart after changing it?
Restarting is the safest way to make sure all services use the new level.
Does this affect Microsoft account or PIN sign-in?
No. It only affects NTLM network authentication, such as connecting to shared folders and some servers, not signing in to your own PC.
Leave a Reply