Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard

Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025 enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default. This planned security-hardening change is part of the boarder Microsoft effort to phase out NTLM. Microsoft originally documented the change in August 2025. This change applies only on devices with Credential Guard disabled, and might cause issues with Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, resulting in possible failure to connect via Single Sign-On pathways.

Windows uses a registry configuration to control whether requests for NTLMv1-derived credentials are audited or blocked. The configuration includes a registry key named BlockNtlmv1SSO. Beginning with the October 2026 security update, Windows uses Enforce mode as the internal default behavior instead of Audit mode, if the registry key BlockNtlmv1SSO has not been previously configured. If the registry key BlockNtlmv1SSO has not been previously configured. Please note this is a planned change in Windows which supports evolving security needs. It is not a known issue with the October 2026 security update. To learn about changes to NTLMv1 in Windows, see KB5066470.

Rollout schedule

Microsoft enabled auditing of NTLMv1-derived credential use on Windows 11, version 24H2 and later versions, starting in late August 2025. The rollout to Windows Server 2025 began in November 2025. Beginning with the October 2026 security update, the default system behavior changes from audit of NTLMv1 connections to enforcing security by restricting NTLMv1 connections. This default change applies only when administrators have not already configured the BlockNtlmv1SSO registry value on the device.

Impact on your organization

Devices running Windows 11, version 24H2 and later versions, or Windows Server 2025, might be affected when Credential Guard is disabled and network authentication depends on NTLMv1-derived credentials. In Enforce mode, Windows blocks requests to generate NTLMv1-derived credentials. Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2, for Single Sign-On might consequently fail to connect automatically. Manually entering credentials can continue to work, but credentials cannot be saved for future use in these scenarios. As a result, workflows that previously established connections without user interaction might no longer function as expected.

Devices with Credential Guard enabled already block the affected NTLMv1-derived Single Sign-On behavior and are not subject to the October 2026 default change.

Action required/recommendations

Organizations should identify affected authentication configurations and select one of the following approaches:

• Recommended: Remove dependencies on MS-CHAPv2. Migrate Wi-Fi and VPN connections from MS-CHAPv2-based authentication, such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication, such as PEAP-TLS or EAP-TLS. MS-CHAPv2-based endpoints are subject to risks similar to those affecting NTLMv1.

• Temporary compatibility option: Return affected devices to Audit mode. Open the Windows registry and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.Here, create or configure the BlockNtlmv1SSO value as type REG_DWORD and set its data to 0. Windows will audit requests for NTLMv1-derived credentials and allow them to succeed, temporarily restoring compatibility. Note that warning Event ID 4024 will appear in the Microsoft-Windows-NTLM/Operational log, allowing the audit of connection events. Guidance in KB5066470 can be used to identify and remove remaining dependencies on NTLMv1-derived credentials. After removing these dependencies, return to the Enforce mode by setting BlockNtlmv1SSO to 1. Windows then blocks affected requests and records error Event ID 4025. As this change affects the security level of the device, it should be evaluated carefully and not used long-term.

Carefully review KB5066470 for complete rollout, auditing, and registry configuration guidance.

Compliance considerations

Organizations that temporarily use Audit mode should assess the continued generation of NTLMv1-derived credentials against their security and compliance requirements. Organizations should document the exception, limit its duration, monitor Event ID 4024, and establish a plan to return affected devices to Enforce mode.

Additional information

• KB5066470 is the source for important rollout, auditing, and registry configuration guidance
• Advancing Windows security: Disabling NTLM by default - Windows IT Pro Blog
• Retiring NTLM: Frequently asked questions - Windows IT Pro Blog
• The Wi-fi and VPN considerations section of Considerations and known issues when using Credential Guard