secpol.msc > Local Policies > Security Options > Network security: Restrict NTLM: Incoming NTLM traffic > Deny all accounts