Key points
- The October 2026 Windows update blocks NTLMv1-derived credentials for Single Sign-On by default, shifting from audit mode to enforce mode.
- Administrators can temporarily revert to audit mode via the BlockNtlmSSO registry value, but Microsoft warns this reduces security protections.
- The change may impact Wi-Fi, Ethernet, and VPN authentication for domain-joined devices still relying on legacy MS-CHAPv2 connections.
The short version
- Windows now blocks NTLMv1 Single Sign-On requests by default in the October 2026 update, replacing previous warning-only behavior.
- Organizations using legacy authentication methods for Wi-Fi, Ethernet, or VPNs may experience connectivity failures without prior configuration changes.
- Microsoft designed this change to accelerate the removal of NTLM, a protocol deprecated in 2024 and removed from newer Windows versions.
The details
The October 2026 Windows security update introduces a default enforcement of NTLMv1 blocking for Single Sign-On, according to The Register. Prior to this release, Windows allowed these legacy credentials while generating warning events in system logs. The update changes the default behavior of the BlockNtlmSSO registry value. If administrators have not explicitly set this value, the system now operates in Enforce mode rather than Audit mode. This shift actively blocks requests that rely on NTLMv1-derived credentials.
This change can disrupt network connectivity for devices that depend on legacy authentication methods. The Register reports that Wi-Fi, Ethernet, and VPN connections may fail if they utilize these deprecated credentials. Administrators retain the ability to set the BlockNtlmSSO registry value to zero, which reverts the system to Audit mode. This temporary adjustment allows NTLMv1-derived Single Sign-On credentials to function again. Microsoft cautions that using Audit mode reduces the security protections offered by Enforce mode and should only be considered a scoped, temporary exception.
The context
Microsoft has been moving toward the elimination of NTLM for several years, stating in 2023 that its end goal is removing the need for the protocol entirely. NTLM was added to the deprecation list in 2024, and Microsoft introduced audit logs for NTLMv1 usage in late August 2025. The protocol originated in 1993 with Windows NT 3.1, making it significantly less secure by modern standards.
Microsoft removed NTLM from Windows 11 24H2 and Windows Server 2025. However, remnants of the protocol persist in some enterprise environments. The Register notes that these remnants are often found in domain-joined environments using MS-CHAPv2-based connections. This includes PEAP-MSCHAPv2 and EAP-MSCHAPv2 authentication methods. The longevity of NTLM has made its removal from enterprise networks a complex challenge for many organizations.
What to watch
- Monitor system logs for authentication failures immediately following the installation of the October 2026 update.
- Identify devices and services that still rely on NTLMv1 for Single Sign-On or network access.
- Plan a migration path to modern authentication protocols to avoid future disruptions from enforced deprecation.
- Review temporary registry adjustments to ensure they are removed once legacy dependencies are resolved.
What it means for organisations
Operations teams must assess their current authentication infrastructure to identify dependencies on legacy protocols. IT leaders should communicate with network and security groups to understand the scope of potential connectivity issues. Procurement and supplier management teams need to verify that third-party systems and devices support modern authentication standards. This event highlights the operational risk of delaying technology migrations. Organizations should treat legacy protocol support as a critical security exception rather than a standard configuration.
What to do and how to stay safe: Windows
- Audit your network logs to identify any systems or users still authenticating via NTLMv1 before applying the update.
- Verify that all Wi-Fi, Ethernet, and VPN configurations use modern authentication methods like Kerberos or current EAP standards.
- Test the update in a non-production environment to detect any authentication failures before widespread deployment.
- Consult with network administrators to ensure that any temporary registry changes are documented and scheduled for removal.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is this a bug in the October 2026 Windows update?
No, Microsoft states that the blocking of NTLMv1 Single Sign-On is by design and part of a long-term deprecation plan.
Can I revert the change if my network breaks?
Yes, administrators can set the BlockNtlmSSO registry value to 0 to temporarily allow NTLMv1 credentials, though this reduces security.
Which authentication methods are affected by this change?
The change affects NTLMv1-derived credentials for Single Sign-On, including those used in MS-CHAPv2-based connections like PEAP-MSCHAPv2.
