LTM 11.1.0+ HTTP monitor with native NTLM auth

After struggling for a few hours with HTTP monitors using the native NTLM solution (after the initial BASIC auth request fails), I'm not convinced that it's correctly forming the NTLM request.

 

The web server constantly returns 401.2 responses and the following is logged in to the server's Security event log:

 

Account For Which Logon Failed:

 

Security ID: NULL SID

 

Account Name:

 

Account Domain:

 

Failure Information:

 

Failure Reason: Unknown user name or bad password.

 

Status: 0xc000006d

 

Sub Status: 0xc000006a

 

It seems that 0xc000006a means "User logon with Misspelled or bad Password". I know for a fact that the password specified in the monitor is correct, and when capturing the BASIC auth request it shows as such; something is going wrong during the NTLM auth request.

 

Since the request is hashed I've got no way of figuring out whether the username and password are correct so I was wondering if anyone else has successfully used the native NTLM auth functionality of the HTTP monitor since it was implemented in 11.1.0.

 

Thanks