---
title: IncomingNTLMTrafficAuditing enum | Wartiva GraphQL API
description: GPO policy: "Network security: Restrict NTLM: Audit Incoming NTLM Traffic". Wartiva GraphQL API reference with arguments, fields, and examples.
url: https://wartiva.com/api-docs/types/incoming-ntlm-traffic-auditing.html
updated: 2026-10-07
---

Endpoint configuration · GraphQL enum

# `IncomingNTLMTrafficAuditing` enum

GPO policy: "Network security: Restrict NTLM: Audit Incoming NTLM Traffic" under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0:AuditReceivingNTLMTraffic (REG_DWORD). Reference: [Network security: Restrict NTLM: Audit incoming NTLM traffic](https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic)

## Values

| Enum Value | Description |
|---|---|
| `DISABLED` | Incoming NTLM traffic is not audited. |
| `AUDIT_DOMAIN_ACCOUNTS` | Audit incoming NTLM pass-through authentication for domain accounts. |
| `AUDIT_ALL_ACCOUNTS` | Audit incoming NTLM traffic for all accounts. |

## Used by

- [`NetworkSecurityPolicy`](https://wartiva.com/api-docs/types/network-security-policy.html) type: Controls local security authority, Kerberos, and NTLM parameters for network authentication and encryption policies on Windows.

## Example

### Example

```json
"DISABLED"

```

---

Wartiva is in early access. Request access: https://wartiva.com/early-access.html  
All pages: https://wartiva.com/llms.txt