Windows now blocks NTLMv1 single sign-on by default on 24H2 and later

Windows now blocks NTLMv1 single sign-on by default on 24H2 and later

15 October 2026: The October 2026 security update for Windows 11 versions 24H2, 25H2 and 26H2 and for Windows Server 2025 switches the BlockNtlmv1SSO setting from audit to enforce wherever an administrator has not set it. On devices with Credential Guard turned off, Windows now refuses to generate NTLMv1-derived credentials for single sign-on, and Microsoft warns that Wi-Fi, Ethernet and VPN connections that authenticate with MS-CHAPv2 may stop connecting on their own.

Microsoft posted the Message Center notice MC1508562 on 15 October and tagged it a major change with admin impact. Its support article KB5066470, first published on 29 August 2025, was rewritten on 14 October to describe enforcement. The update itself shipped on 13 October as KB5127648 for Windows 11 and KB5126646 for Windows Server 2025.

Which connections stop working

The NTLMv1 protocol itself was removed from Windows 11 24H2 and Windows Server 2025. What remains, Microsoft explains, are pieces of NTLMv1 cryptography inside higher-level protocols, chiefly PEAP-MSCHAPv2 and EAP-MSCHAPv2 in domain-joined environments. Those are the methods many company Wi-Fi networks, wired 802.1X ports and older VPN gateways use to sign a user in with their Windows credentials.

Under enforcement the automatic sign-in fails. A user can still type a username and password and connect, but Windows will not save them, so the prompt comes back next time. Laptops that join the office network at the login screen, before anyone has signed in, are the likeliest source of help desk calls.

Devices with Credential Guard enabled are untouched, because Credential Guard already blocks this behaviour, and Microsoft recommends turning it on wherever it is supported. It also stresses that this is planned hardening and not a known issue with the update.

Finding the dependency in the event log

Since auditing began in late August 2025 on clients, and from November 2025 on Windows Server 2025, Windows has recorded each use of an NTLMv1-derived credential in the Microsoft-Windows-NTLM/Operational log as event 4024, a warning. Under enforcement the same attempt is logged as event 4025, an error stating that it "was blocked due to policy". Both events name the target server and the client process, which leads to the network profile or VPN client involved.

A search for 4024 events across the fleet shows which sites and profiles still depend on MS-CHAPv2 before the update reaches every machine. Devices that already have the October update will show 4025 instead.

The registry exception and its limits

The lasting fix Microsoft names is certificate-based authentication for Wi-Fi and VPN, PEAP-TLS or EAP-TLS, which takes the password out of the exchange. Where that cannot happen quickly, setting the BlockNtlmv1SSO DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 to 0 restores audit mode, and 1 enforces it. The update does not create the value. It only changes what Windows does when the value is missing, so a value an administrator set earlier keeps its effect.

Microsoft says audit mode reduces protection and should be used only as "a scoped, temporary security exception" while the migration is finished.

Our VPN software category lists 13 products and our authentication software category lists six, for teams reviewing how remote access signs users in.

Related on TrustList:

• FBI warns FortiBleed is still hitting exposed FortiGate VPNs
• Ivanti Connect Secure zero-day lets attackers run commands unauthenticated
• HPE iMC authentication bypass (CVSS 9.1) is fixed in 7.3 E0713

Sources

• Microsoft Support: KB5066470, Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025 (updated 14 October 2026), 14 October 2026
• Microsoft 365 Message Center MC1508562 (archive copy): NTLMv1 hardening changes might affect network connections on devices without Credential Guard, 15 October 2026