October Windows update blocks NTLMv1 credentials by default, risking network log-in issues
The October 2026 Windows security update now blocks NTLMv1-derived credentials for Single Sign-On by default when administrators have not explicitly chosen Audit mode. This may disrupt Wi-Fi, Ethernet or VPN authentication in organisations still relying on the old protocol, and signals that Microsoft is moving closer to removing NTLMv1.
Previously, Windows allowed these credentials while recording warning events; the update switches the default for the `BlockNtlmSSO` registry setting from Audit to Enforce. Administrators can set it to `0` to temporarily restore the previous behaviour, but Microsoft says Audit mode should be a limited, temporary exception. NTLM dates back to 1993, and despite earlier removal from Windows 11 24H2 and Windows Server 2025, it can remain in some domain-connected MS-CHAPv2 setups.
- Windows now blocks NTLMv1 Single Sign-On credentials by default.
- Legacy authentication may disrupt Wi-Fi, Ethernet or VPN access.
- Audit mode is a temporary exception as Microsoft phases out NTLMv1.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Blocking NTLMv1 by default strengthens security by reducing reliance on an old protocol and limiting exposure to credential attacks. A clear default also encourages organisations to migrate to safer authentication methods, while the temporary Audit-mode exception gives administrators a way to identify and manage remaining dependencies.
The case against
Changing the default can unexpectedly disrupt Wi-Fi, Ethernet or VPN log-ins in organisations whose legacy systems still depend on NTLMv1. Those organisations may need time and resources to find affected setups and update them, so keeping the previous behaviour until administrators have assessed their networks could avoid outages while still allowing a planned transition.
Business Markets Software Technology
Read the full article at the source →
Originally published by The Register as “Networking problems after the October 2026 Windows update? NTLM might be to blame”.