After the October 13 security updates KB5127648 for Windows 11 and KB5126646 for Windows Server 2025, 802.1X authentication failures are spreading across enterprise Wi-Fi, wired LAN, and VPN connections as NTLMv1 blocking switches to its previously announced enforcement default. Microsoft has updated its support article with a temporary registry workaround.
Key points
- What happened: After KB5127648, NTLMv1 blocking switched to Enforce, blocking Wi-Fi and VPN connections that use 802.1X authentication
- Why it matters: Setting BlockNtlmv1SSO back to 0 weakens NTLMv1 protections, so Microsoft recommends the workaround only as a temporary exception
- What to watch: Organizations need to migrate from MS-CHAPv2 to certificate-based authentication such as EAP-TLS during the grace period gained by returning to Audit mode
What happened
In October's monthly update, Microsoft changed the internal default behavior on devices without a configured BlockNtlmv1SSO registry value from Audit mode, which logs warnings but allows authentication, to Enforce mode, which blocks authentication. The change covers all editions of Windows 11 24H2, 25H2, and 26H2, plus Windows Server 2025, and affects environments where Credential Guard is disabled and BlockNtlmv1SSO has not been manually configured.
802.1X authentication using PEAP-MSCHAPv2 or EAP-MSCHAPv2 relies on cryptographic operations derived from NTLMv1, which Enforce mode blocks. As a result, devices authenticating through single sign-on (SSO) to Wi-Fi, wired LAN, or VPN connections in domain-joined environments lost connectivity.
The important distinction is that only automatic SSO authentication is blocked. According to Microsoft, authentication using manually entered credentials continues to work in Enforce mode.
From Audit to enforcement: a phased transition over a year
This change did not arrive without warning.
Microsoft removed the NTLMv1 protocol itself from Windows 11 24H2 and Windows Server 2025 in late 2024. However, remnants of NTLMv1 cryptographic processing remained in connections based on MS-CHAPv2 and elsewhere.
In August 2025, Microsoft introduced the BlockNtlmv1SSO registry value to control these remaining NTLMv1-derived credentials. Located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0, it operates in Audit mode, allowing authentication and logging warnings, when set to 0, or Enforce mode, blocking authentication, when set to 1.
Beginning in September 2025, Audit mode gradually rolled out to Windows 11 24H2 and later clients, logging event ID 4024 whenever NTLMv1-derived credentials were used. Rollout to Windows Server 2025 began in late 2025. This was a grace period for administrators to review the logs and identify dependencies.
Then, with the October 13, 2026 update, the default switched to Enforce when BlockNtlmv1SSO is not configured. Joho no Todai confirmed that the change neither creates nor modifies a registry value. The value remains absent; only Windows' internal behavior changes. An administrator opening Registry Editor will therefore find no BlockNtlmv1SSO value. Under this design, absence means enforcement.
Devices with Credential Guard enabled are unaffected because Credential Guard itself already blocks legacy NTLMv1 cryptography. Microsoft recommends enabling Credential Guard on systems that meet its requirements.
The workaround and its cost
Microsoft's published temporary workaround is to explicitly set BlockNtlmv1SSO to 0, or Audit. At the registry path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0, create a REG_DWORD value named BlockNtlmv1SSO and set its data to 0. A restart is reportedly unnecessary.
Microsoft (machine-translated)
This allows NTLMv1-derived SSO authentication again, restoring 802.1X connectivity.
However, Microsoft warns that returning to Audit mode weakens the protections offered by Enforce mode and should be used only as a narrowly scoped, temporary security exception. It is a stopgap until migration is complete, rather than a permanent solution.
The fundamental response is to migrate authentication configurations that depend on MS-CHAPv2 to certificate-based methods such as EAP-TLS. Retiring NTLMv1 is Microsoft's established policy, and the enforcement change is not expected to be reversed. Choosing to return to Audit mode amounts to temporarily removing a new lock so an old key can keep being used.
KB5127648 has also caused Xbox Live sign-in failures this month (in Japanese). Authentication changes in this monthly update have had unexpected effects across multiple connection paths. NTLMv1 blocking enforcement itself was announced 14 months in advance, but for environments that have not migrated away from MS-CHAPv2, either the grace period was insufficient despite that notice, or the work was given the wrong priority.
Originally published on Joho no Todai. The Japanese original is here.
