What changed in October 2026?
Windows updates released on and after 13 October 2026 changed the default handling of credentials derived from NTLMv1. On an eligible device where Credential Guard is disabled and the BlockNtlmv1SSO registry value has not been configured, Windows now uses Enforce mode instead of Audit mode.
Before the change, Windows allowed the relevant single sign on request and wrote a warning to the event log. It now blocks that request and writes an error. The update does not create or alter the registry value. The stronger behaviour becomes the internal default while the value remains absent.
Microsoft says the change applies to Windows 11 versions 24H2, 25H2, 26H1 and 26H2, together with Windows Server 2025. It is part of the wider removal of older NTLM authentication, not a temporary known issue with the October update.
Why can this affect Wi Fi, Ethernet and VPN connections?
The NTLMv1 protocol itself has been removed from Windows 11 version 24H2 and Windows Server 2025 and later releases. However, Microsoft explains that remnants of NTLMv1 cryptography can still be used by some higher level authentication methods.
The main concern is a domain joined environment using MS CHAPv2 for single sign on. Examples include PEAP with MS CHAPv2 and EAP with MS CHAPv2, which have commonly been used for enterprise Wi Fi, authenticated Ethernet and some VPN connections.
A connection can therefore appear to use a modern Windows device and a central authentication server while still depending on older credential handling behind the scenes. The October change exposes that dependency by refusing to generate the older credential material automatically.
Which organisations are most likely to notice a problem?
Most ordinary home Wi Fi connections will not be affected. The risk is greater where Windows signs a staff member into a managed network or VPN using their domain identity without asking them to enter the password again.
Businesses, schools and other organisations should check any centrally authenticated wireless network, wired 802.1X deployment or remote access VPN that uses MS CHAPv2. Older network access policies, RADIUS configurations and connection profiles deserve particular attention.
The October behaviour change only applies through this route where Credential Guard is disabled and BlockNtlmv1SSO is not configured. A failed Wi Fi or VPN connection can have many other causes, so the date of the update alone is not proof. Confirm the evidence before changing security settings.
- Staff devices normally connect with their Windows account without another password prompt.
- The connection profile uses PEAP with MS CHAPv2 or EAP with MS CHAPv2.
- The device is domain joined and has received the October 2026 Windows security update.
- The same user can connect after entering credentials manually, but automatic sign in fails.
- The Windows NTLM operational log records Event ID 4025 at the time of the failure.
What might users see?
The visible symptom depends on the connection and how it was deployed. A laptop may repeatedly ask for credentials, remain disconnected from the organisation's wireless network, fail network authentication on a wired connection or stop establishing a VPN automatically.
Microsoft confirms that the enforced change blocks the single sign on flow. Manually entering credentials can continue to work in this specific scenario. That distinction is useful during diagnosis, but repeatedly asking users for passwords is not a suitable long term design and can create more opportunities for credential theft.
Do not train staff to approve unexpected prompts or enter their organisation password into an unfamiliar window. Confirm that any prompt belongs to the approved Windows connection profile and report unusual requests to IT.
How IT can confirm whether the change is responsible
Microsoft added specific events so administrators can identify this dependency. In Event Viewer, check Applications and Services Logs, Microsoft, Windows, NTLM, then Operational on an affected Windows device.
Event ID 4024 is a warning recorded in Audit mode when Windows allows an attempt to use NTLMv1 derived credentials for single sign on. Event ID 4025 is an error recorded in Enforce mode when that attempt is blocked by policy. The entry can include the target, user, domain and client process, which helps identify the affected connection.
Match the event time to the user's connection attempt and review the approved network or VPN profile. Also check the Windows version, installed update, Credential Guard status, relevant policy and the authentication method configured by the RADIUS or VPN service. One event should be treated as evidence to investigate, not permission to weaken the whole environment.
Do not treat Audit mode as the permanent fix
Microsoft provides the BlockNtlmv1SSO setting so administrators can select Audit or Enforce behaviour. Setting the value to 0 allows the older single sign on request while producing warning events. Setting it to 1 blocks the request and produces errors.
Microsoft describes Audit mode as a temporary security exception for a critical dependency that cannot be migrated immediately. It reduces the protection provided by Enforce mode. Any exception should therefore be limited to the necessary devices, approved by the responsible organisation, recorded with a named owner and accompanied by a removal date.
Avoid publishing registry commands for users to apply themselves. Group Policy, Intune or another managed method should be used where an authorised IT team decides a temporary exception is necessary. Removing the security update is not a migration plan and can expose the device to unrelated vulnerabilities fixed by the same update.
The long term answer is certificate based authentication
Microsoft recommends moving Wi Fi and VPN connections away from MS CHAPv2 methods such as PEAP with MS CHAPv2 and EAP with MS CHAPv2. Its recommended direction is certificate based authentication such as EAP TLS or PEAP TLS.
Certificates remove the need to generate the older password derived credential used by this single sign on flow. They can also give the organisation stronger control over which managed users and devices are allowed to connect. The improvement depends on sound certificate enrolment, renewal, revocation and trust configuration.
Plan the change rather than replacing every connection profile at once. Confirm RADIUS and network equipment support, decide whether users, devices or both receive certificates, test with a representative pilot group, document recovery and then deploy through the organisation's management platform.
- Inventory wireless, wired and VPN profiles that use central authentication.
- Identify PEAP with MS CHAPv2 and EAP with MS CHAPv2 dependencies.
- Review Event IDs 4024 and 4025 across a representative set of devices.
- Confirm the certificate authority, RADIUS service and network equipment design.
- Test enrolment, renewal, revocation and access for users working away from the site.
- Pilot the replacement profile before broad deployment.
- Remove temporary Audit exceptions after the new authentication method is proven.
Microsoft recommendation for certificate based Wi Fi and VPN authentication
Practical checks for businesses and schools
Ask your IT provider which authentication method is used for staff Wi Fi, authenticated Ethernet and remote access VPN. The answer should name the method and the service that validates it, rather than simply saying that the network uses a password or RADIUS.
Schools should check staff, administrative and curriculum networks separately. A temporary workaround must not weaken filtering, safeguarding or separation between managed and unmanaged devices. Test staff laptops used at home as well as devices that remain on site.
Businesses should include remote workers, branch offices and supplier managed VPN services. Document the owners of the firewall, wireless platform, RADIUS service, certificate system and Windows device policy so that a change is not delayed by unclear responsibility.
How Bury I.T. Support can help
Bury I.T. Support Ltd can review Windows devices, wireless and VPN profiles, RADIUS authentication, Group Policy and event logs to establish whether the October change is responsible for a connection problem.
Where an older dependency exists, we can help document the risk, apply a controlled temporary measure where it is justified and plan a move to certificate based authentication. The aim is to restore reliable access without undoing the security improvement Microsoft introduced.
We support businesses and schools across Greater Manchester and Lancashire with Windows, networks, Wi Fi, firewalls and remote access. If users have started reporting connection prompts or failures after the October updates, record which device, network and time were involved before contacting the IT team. That evidence can make the investigation much faster.
Official sources and further reading
These primary sources were checked when this article was last reviewed.