How to fix Error 1937 on Windows 11

by

Troubleshooting Guide: Error 1937 – NTLM Authentication Disabled

Why This Error Happens

This error occurs because Windows 11 has Network Security policies configured to restrict or completely disable NTLM authentication, typically through Group Policy settings (Network security: Restrict NTLM policies). This is often intentional in enterprise environments for security hardening, but it breaks authentication for legacy applications, older network shares, or services that still rely exclusively on NTLM rather than Kerberos. Additionally, a misconfigured Local Security Policy or a domain-level GPO pushed from a controller can inadvertently disable NTLM even on systems that require it for specific connections.

Step-by-Step Resolution Guide

Step 1: Check Local Security Policy Settings

  • Press Win + R, type secpol.msc, and hit Enter.
  • Navigate to Local Policies > Security Options.
  • Look for entries starting with Network security: Restrict NTLM.
  • Verify if any of these are set to “Deny All” or similarly restrictive values.

Step 2: Modify NTLM Restriction Policies

  • Locate Network security: Restrict NTLM: NTLM authentication in this domain.
  • Change the value from “Deny All” to “Allow all” or “Not Defined” depending on your organizational needs.
  • Also check Network security: Restrict NTLM: Incoming NTLM traffic and set it to “Allow all accounts” if blocking is not required.
  • Click Apply and OK to save changes.

Step 3: Update Group Policy via Registry (If GPO is Enforced)

  • Press Win + R, type regedit, and hit Enter.
  • Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.
  • Locate the RestrictReceivingNTLMTraffic and RestrictSendingNTLMTraffic DWORD values.
  • Set these values to 0 (Allow All) if you need to re-enable NTLM traffic.
  • Restart the machine for changes to take effect.

Step 4: Force Group Policy Refresh

  • Open Command Prompt as Administrator.
  • Run the command: gpupdate /force
  • Wait for the policy update to complete, then restart the system if prompted.

Alternative or Verification Steps

  • To verify the fix, attempt the original authentication process (e.g., mapping a network drive or logging into the legacy application) again to confirm the “Error 1937” no longer appears.
  • If the issue persists and NTLM must remain disabled for security compliance, consider migrating the affected application or service to support Kerberos authentication instead, as re-enabling NTLM broadly is generally discouraged for long-term security posture.