NTLMv1 SSO: Check Wi-Fi, LAN and VPN sign-ins after the October update

Research status: November 2, 2026.Microsoft changed the default behavior for certain NTLMv1-derived credentials with the October 13, 2026 security update. Domain-joined Windows devices that use MS-CHAPv2-based single sign-on for WLAN, Ethernet or VPN can be particularly affected. This does not mean that every network connection fails: the specific authentication chain, the device status and Credential Guard are crucial.

Short conclusion

On devices with Credential Guard disabled and registry value not setBlockNtlmv1SSOAfter the October update, Enforce applies instead of Audit. Windows then blocks certain NTLMv1-derived SSO requests. IT teams should first log the eventsMicrosoft-Windows-NTLM/Operationalevaluate and assign affected profiles and authentication servers. The sustainable way is to reduce dependencies on MS-CHAPv2 single sign-on and – where appropriate – switch to certificate-based procedures such as PEAP-TLS or EAP-TLS. An exception in audit mode should be limited in time and documented.

What changed in October 2026

Windows 11 24H2, 25H2, 26H1 and 26H2 as well as Windows Server 2025 are mentioned in Microsoft's current application overview. The change affects devices without activated Credential Guard ifBlockNtlmv1SSOis not set. Before the October update, this case was logged and allowed by default; with the update is blocked by default. The update itself does not create or change the registry value. A value that has already been set remains relevant.

The NTLMv1 protocol mode has been removed from the mentioned Windows versions. However, Microsoft describes residual NTLMv1-derived cryptography in certain MS-CHAPv2 scenarios, such as PEAP-MSCHAPv2 and EAP-MSCHAPv2 in a domain environment. This is why a login can be affected even though administrators no longer have a classic NTLMv1 configured.

Distinguish the three states correctly

The documented path isHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsaMSV1_0; the value is aREG_DWORD. According to Microsoft, a restart is not required after changing this value. Before making registry or policy changes, administrators should consider their central configuration management and change approvals.

This is how administrators check the cause

1. Limit device group:Record Windows version, installed October security level, domain status and Credential Guard status. The new standard change does not apply equally to every device.
2. Evaluate NTLM events:In Event Viewer, look for 4024 (Audit) and 4025 (Block) under Applications and Services Logs > Microsoft > Windows > NTLM > Operational. Event time, target server and process name help with mapping.
3. Check network path:Match affected SSID, wired 802.1X profile or VPN profile with RADIUS/NPS and authentication settings. MS-CHAPv2 alone is not sufficient as proof of error; The decisive factor is the specific use of SSO.
4. Migrate test group:Select a small group of devices and users with the network and identity team. Set up certificate-based authentication, document rollback and support path and only roll it out more broadly after successful testing.

Recommended transition path and considerations

Microsoft recommends identifying dependencies on MS-CHAPv2 and switching WLAN and VPN logins to certificate-based procedures. In the Credential Guard notes, Microsoft names PEAP-TLS and EAP-TLS as alternatives to PEAP-MSCHAPv2 and EAP-MSCHAPv2 respectively.

• Advantage of the change:Registration no longer relies on the described NTLMv1-derived SSO path.
• Planning effort:Certificate issuance, renewal, device provisioning and authentication servers must fit together and be tested.
• Transitional exception: BlockNtlmv1SSO=0According to Microsoft's instructions, can temporarily allow a critical dependency, but lowers the protection. Device scope, responsible person, expiry date and migration step belong in the exception documentation.

Don't automatically confuse 4024/4025 with Credential Guard events: Microsoft lists its own event identifiers for Credential Guard blocks. Therefore, check the event source, log, and status of the device before determining a cause.

Checklist before rollout

• Devices with appropriate Windows version and October update inventoried
• Credential Guard and existingBlockNtlmv1SSO-Values ​​read out
• 4024/4025 events correlated with process, target server and network profile
• WLAN, Ethernet and VPN considered separately
• Certificate profile, renewal and restoration tested in a pilot group
• Temporary exceptions provided with expiration date and responsible person

Frequently asked questions

Does every WLAN with MS-CHAPv2 fail after the update?

No. According to Microsoft, the change may affect applicable single sign-on flows; According to the FAQ, manually entered access data still works. Which connection is affected must be checked based on the specific environment and events.

Does the update change my registry?

No. Microsoft says the update does not create or edit the value. If it is missing, only the internal standard on the affected devices changes from Audit to Enforce.

Is this a bug in the October update?

Microsoft describes the measure as a planned security tightening and not as a known error in the update. A failed login should still be diagnosed based on events and authentication chain.

Sources and test notes

The instructions are an evaluation of Microsoft documentation, not a measurement or independent laboratory test. Technical statements were verified as of November 2, 2026 using the following sources:

• Microsoft Support: Manage NTLMv1 changes and prevent network authentication issues in Windows (KB5066470)
• Microsoft Learn: Considerations and known issues when using Credential Guard
• Microsoft Learn: Policy CSP - LocalPoliciesSecurityOptions
• Microsoft Learn: Windows message center, announcement October 14, 2026

Appropriate official explanatory video was checked, but the research did not find a sufficiently specific, verified video for this specific NTLMv1-SSO change; therefore no video is embedded. Author: TechDesk PE Digital.Networks.