diff --git a/scripts/base/protocols/ntlm/main.bro b/scripts/base/protocols/ntlm/main.bro
index 484ccf334f..5252157d7c 100644
--- a/scripts/base/protocols/ntlm/main.bro
+++ b/scripts/base/protocols/ntlm/main.bro
@@ -16,7 +16,7 @@ export {
 		domainname: string &log &optional;
 
 		## Indicate whether or not the authentication was successful.
-		success: bool &log &default=F;
+		success: bool &log &optional;
 
 		## Internally used field to indicate if the login attempt 
 		## has already been logged.