Block NTLMv1 usage

This setting controls the behavior of NTLMv1 authentication. Audit Mode (0): Logs Event ID 4024 (Warning) when NTLMv1-derived credentials are used but allows authentication to proceed. Enforce Mode (1): Blocks NTLMv1-derived credential usage and logs Event ID 4025 (Error). Microsoft plans to change the default behavior to Enforce Mode in future Windows versions (starting with Windows 11, version 24H2 and Windows Server 2025). For more information, see https://support.microsoft.com/topic/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025-c0554217-cdbc-420f-b47c-e02b2db49b2e