Windows 11's October update now blocks old NTLMv1 sign-in by default, which can affect Wi-Fi and VPN logins

Microsoft's support page for the 13 October 2026 Windows 11 update (KB5127648) carries a note added on 15 October. After installing it, when the BlockNtlmv1SSO registry value is not set, Windows uses Enforce mode (1) instead of Audit mode (0), which blocks NTLMv1-derived credentials for single sign-on. The change applies only on devices where Credential Guard is disabled, and Microsoft says it might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2-based authentication. The update does not create or change the registry value. The page lists no known issues for this change.

• Ask whoever runs your IT whether your office Wi-Fi or VPN signs in with MS-CHAPv2 or PEAP-MSCHAPv2. If it does, test one Windows 11 PC after the update before it reaches the rest.
• If a PC loses its connection after the update, tell your IT support about the BlockNtlmv1SSO setting. Microsoft's guidance is that setting it back to Audit mode is a temporary exception, not a fix.

Source: Microsoft Support. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. Image: Microsoft, from its own announcement. How we source and credit