NTLMv1 SSO enforcement phases
Any two versions this installation kept of the page, compared the same way as each observed change. All guidance changes · Latest observation
What changed across 2 changes
27 new passages (about 670 words), 11 edited passages (126 words changed), 4 removed passages (about 110 words). The changed wording mentions dates and deadlines, defaults, prerequisites, supported platforms, mitigations, settings and controls. Review the source to confirm the effect.
May need admin actionCheck whether new requirements apply to your setup; check whether a default changed for your tenant or devices; check the dates against your plans.
[added: This article details changes related to auditing and enforcement of blocking NTLMv1-derived cryptography in Windows. The changes apply to the Windows versions listed in Applies] …
[added: Windows updates released on and after October 13, 2026, strengthen NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not] …
… some scenarios, such as when using[removed: MS-CHAPv2][added: MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2,] in a domain-joined environment.
[added: Beginning with Windows updates released in August 2025, Audit mode was introduced to help administrators identify dependencies on NTLMv1-derived credentials before enforcement.]
… Credential Guard’s requirements are met. The[removed: upcoming]changes [added: outlined in this article] only affect devices where Credential[removed: g][added: G]uard is disabled; if Windows Credential Guard is enabled on the device, the[added: se] changes[removed: outlined in this article]do not take effect.
Short quotes of Microsoft's changed wording from Microsoft source, © Microsoft Corporation. Read the page for the full text.
Sections to inspect
- Introduction
- Background
- Goal
- Changes
- New registry key
- New auditing capabilities
- Rollout of changes
- Timeline
- Preparing for Enforce mode
- Temporary security exception
- Frequently asked questions (FAQ)
- References
Read the current Microsoft source
Compared across every change between the two versions, so an edit made and later undone does not show. Observation time is not publication time. Full source bodies are not published; as the page's license allows, only Microsoft's changed wording is shown.