Windows 11 users across the US and India are reporting Wi-Fi, Ethernet, and VPN authentication failures after installing Microsoft’s October 2026 security update — and the culprit is not a bug, but deliberate enforcement of a years-old deprecation plan: NTLMv1 is now blocked by default. The change affects domain-joined systems where legacy MS-CHAPv2-based connections (like PEAP-MSCHAPv2 or EAP-MSCHAPv2) still rely on NTLMv1-derived credentials for Single Sign-On.
It does not affect Windows 11 24H2 or Windows Server 2025, which already removed NTLM entirely, but it does hit earlier supported versions still in active enterprise use, including Windows 11 23H2 and Windows Server 2022. The trigger is the BlockNtlmSSO registry value: if unset, Windows now defaults to Enforce mode (1), blocking NTLMv1-derived SSO requests outright.
Previously, it defaulted to Audit mode (0), logging warnings but allowing access. Administrators can temporarily revert to Audit mode. But Microsoft explicitly warns that doing so “reduces the protection provided by Enforce mode” and should be used only as a “scoped, temporary security exception.” This isn’t new urgency. Microsoft added NTLM to its official deprecation list in 2024, began logging NTLMv1 usage in August 2025, and has stated since 2023 that its “end goal is eliminating the need to use NTLM at all.” The October 2026 update is the first time enforcement ships enabled by default, a hard nudge for environments where migration stalled.
Be the first to comment
Join the argument. No password, just your email or a passkey.