Exchange Server 2019 Default Frontend Connector Received huge Spam request to authentication.

Question

Default Frontend Connector received the Message like that "Hello [106.219.68.200 - random ip address] SIZE 37748736 PIPELINING DSN ENHANCEDSTATUSCODES AUTH NTLM LOGIN X-EXPS GSSAPI NTLM 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XRDST

Is it mean that through the NTLM Protocol to authentication ? if yes, Can we block the NTLM protocol ?

Or we can apply other setting in the server to limited the authentication type ?

Answer 1

Hi @IT301

Welcome to the Microsoft Q&A platform!

Yes, it means authentication by NTLM protocol. You can disable the NTLM protocol by means of Group Policy, which is much simpler:

1.Open the Group Policy Management Console (gpedit.msc).

2.Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

3.Locate and configure Network Security: LAN Manager Authentication Level to Send NTLMv2 response to deny LM and NTLM only

If you need stronger security, consider registry settings: Exchange Server support for Windows Extended Protection | Microsoft Learn

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".