October Windows Update Defaults to Blocking NTLMv1, Breaking Some Network Logins

The October 2026 Windows security update changes how Windows handles NTLMv1-derived credentials. Previously, systems using the legacy protocol for single sign-on would generate warning events but still allow the request. After the update, if the BlockNtlmSSO registry value is not explicitly set, Windows defaults to Enforce mode, which blocks those requests entirely.

That means authentication for Wi-Fi, Ethernet, and VPN connections can fail in environments that still rely on NTLMv1 remnants. The issue is especially relevant for domain-joined setups using MS-CHAPv2-based protocols such as PEAP-MSCHAPv2 and EAP-MSCHAPv2. Microsoft says the change is intentional, not a bug, and is part of a long-running effort to eliminate NTLM.

Administrators can work around the problem by setting BlockNtlmSSO to 0, returning to Audit mode. However, Microsoft cautions that Audit mode reduces the protection provided by Enforce mode and should only be used as a scoped, temporary exception. NTLM has been part of Windows since 1993, and despite being removed from Windows 11 24H2 and Windows Server 2025, some remnants persist, making migration difficult.