October 2026 Windows Update Could Break Wi-Fi and VPN Logins for Businesses Still Using NTLMv1

Businesses that still depend on the old NTLMv1 authentication protocol may see networking problems after the October 2026 Windows security update. Before the update, Windows allowed NTLMv1-derived credentials for Single Sign-On and simply logged warnings. After it, those requests are blocked. This is by design and not a bug.

The change comes down to a registry value called BlockNtlmSSO. If it has not been set, Windows now defaults to Enforce mode instead of Audit mode, which can affect Wi-Fi, Ethernet and VPN authentication. The update does not set the value itself. Administrators can set it to 0 to temporarily allow NTLMv1-derived credentials, but Microsoft warns that this reduces protection and should only be a scoped, temporary security exception. Blocking applies if Credential Guard is not enabled and the value is not set to Audit mode.

Microsoft has been signalling this move for years. NTLM was added to the deprecation list in 2024, and audit logs for NTLMv1 usage arrived in late August 2025. The protocol dates back to 1993 and has proved hard to remove from enterprise environments. Microsoft has removed it from Windows 11 24H2 and Windows Server 2025, but remnants remain, notably in MS-CHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2 in domain-joined environments.