Microsoft’s October 2026 security update is changing a Windows authentication default that could disrupt network access for organizations still relying on NTLMv1-derived credentials. On affected systems, Windows now uses Enforce mode when the BlockNtlmv1SSO registry value has not been configured, blocking the generation of those credentials for Single Sign-On (SSO). The change applies to Windows 11 versions 24H2, 25H2 and 26H2, and Windows Server 2025. Microsoft’s guidance describes the change as a security measure rather than a defect. [1]
The immediate impact is concentrated in Wi-Fi, wired Ethernet and VPN deployments that use MS-CHAPv2-based authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. Microsoft says automatic SSO connections can fail when the device lacks Credential Guard and the registry value is unset. Users may still be able to connect by entering credentials manually, but Windows may be unable to save credentials for subsequent SSO connections, according to a Microsoft support discussion documenting the behavior. Microsoft Q&A [7]
The October update does not write the registry value for administrators. To create a temporary compatibility exception, IT teams can set BlockNtlmv1SSO to 0, which restores Audit mode while logging the legacy authentication use. Microsoft cautions that Audit mode weakens the protection provided by enforcement and should be limited to a scoped, temporary exception. Administrators should use the resulting audit data to identify affected devices, authentication profiles and applications before removing the dependency rather than treating the registry setting as a permanent fix.
The change is part of a longer NTLM retirement effort. Microsoft added NTLM to its deprecation list in 2024 and introduced expanded NTLMv1 auditing for Windows 11 24H2 and Windows Server 2025 in 2025. Its Windows Message Center notice says in-market Windows client and server versions continue to support NTLM, but the company’s long-term objective is a Windows platform that does not need it. Enhanced auditing information can help domain administrators locate NTLMv1 use on clients, servers and domain controllers. [3]
There is no CVE associated with this change, and Microsoft is not describing it as a vulnerability fix for a newly discovered flaw. Rather, the update tightens a legacy authentication path whose continued presence can expose organizations to weaker credential protections. Teams investigating post-update connection failures should first check whether Credential Guard is enabled, review Windows authentication and NTLM audit events, and inspect 802.1X and VPN profiles for MS-CHAPv2 SSO dependencies.
The durable remedy is to migrate wireless, wired and remote-access authentication to stronger alternatives, typically certificate-based 802.1X or another configuration that does not require NTLMv1-derived credentials. Microsoft’s October 13, 2026 security update documentation confirms that the default changes from Audit mode (0) to Enforce mode (1) when the registry value is absent, making newly reported network failures a likely signal that legacy authentication remains embedded in the environment. The Windows Server 2025 update notes [4]
References
- Manage changes to NTLMv1 and prevent network issues in …
- Windows message center
- October 13, 2026—KB5126646 (OS Build 26100.33650)
- KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi …
