Setting LmCompatibilityLevel in Registry Editor is same as changing Local Security Policy?

Question

I would like to write a batch script to change the

Local Security Policy -> LAN Manager Authentication Level

to "Send LM & NTLM - use the NTLMv2 session security if negotiated".
I added the following statement to my batch script to achieve this:

reg add HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel /t REG_SZ /d 1 /f

I can see in the registry editor that the value was updated, however when I go to

Local Security Policy -> Local Policies -> Security Options -> Network security LAN Manager -> Authentication level

the security setting still shows up as "Not Defined" instead of "Send LM & NTLM - use NTLMv2 session security if negotiated".

Am I doing something wrong?
Is there another way to automate this using a batch script?

Referenced Article:
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level

Answer 1

Your registry value is wrong type (/t REG_SZ in your reg add command). It is a REG_DWORD value, so your LmCompatibilityLevel added value is ignored.

Try instead:

/t REG_DWORD

Otherwise you could also use domain group policy instead of a batch script.

Answer 2

reg.exe add HKLM\System\CurrentControlSet\Control\Lsa\ /v LmCompatibilityLevel /t REG_DWORD /d 1 /f