I use wireshark to sniffer ntlm auth traffic between Client(IE) and server(use http or smb), there are many ntlm flags and fields, could you point out how to specify or change the values(1,2,3 type messages, especillay type3 ) in client or server?I have searched internet, only can get ntlm response level setting through registry(LMCompatibility). looks like IE or DC specify these values automatically?