If your work laptop suddenly can’t join the office Wi-Fi, Ethernet or VPN since Tuesday’s Windows update, the cause may be deliberate. Microsoft says the October 2026 security update, released on 13 October 2026, strengthens NTLMv1 security by changing the default behaviour when the BlockNtlmv1SSO registry value isn’t set. As The Register reports, this isn’t a bug; it’s by design.
What changed
Before the update, an unset value meant Audit mode (0): requests to use NTLMv1-derived credentials for single sign-on were logged as warnings but allowed. Afterwards, Windows uses Enforce mode (1) instead, and those requests are blocked. The update doesn’t create the registry value, so nothing visibly changes on affected machines.
The scope is narrower than a blanket NTLM shutdown. According to Microsoft’s guidance (KB5066470), the change covers Windows 11 versions 26H2, 25H2 and 24H2, plus Windows Server 2025. It applies only when Credential Guard is disabled and the registry value is absent, and it can affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. Microsoft says manually typed credentials still work in Enforce mode, so the failures appear when login is automatic. The Windows 11 release notes for KB5127648 carry the same entry, added on 15 October.
How to check and fix it
Open Event Viewer and look in Microsoft-Windows-NTLM/Operational. Microsoft says a blocked request logs an error, Event ID 4025, whereas the old audit warning was 4024. If you see 4025 entries alongside connection failures, NTLMv1-derived credentials are your problem.
The stopgap is a registry edit. Microsoft lists the location as HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\msv1_0, where you create or edit a REG_DWORD named BlockNtlmv1SSO and set it to 0. No restart is needed. Pureinfotech reports that this restored connectivity on affected machines without uninstalling the update.
Treat it as temporary. Microsoft says audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception. The lasting options are enabling Credential Guard, which Microsoft strongly recommends where hardware requirements are met, or moving off MS-CHAPv2 sign-in. We’d apply the exception only to the devices that need it and use events 4024 and 4025 to find what still depends on it.
Why Microsoft is pushing now
NTLM dates back to 1993, and Windows NT 3.1, and Microsoft added NTLM to its deprecation list in 2024, with audit logs for NTLMv1 usage arriving in late August 2025. The Register notes that there’s no indication of how long the Audit-mode workaround will work and says it will probably last until the next major Windows release. In September, Microsoft said in-market Windows client and server versions will continue to support NTLM, while its long-term goal is a platform that doesn’t need it at all.
For IT teams, this means a post-update Wi-Fi or VPN failure points to an authentication setup that hasn’t been migrated yet, rather than a faulty patch. Rolling back the update would reopen the hole Microsoft is closing, so fixing the dependency is the better route.
Is this a bug in the October 2026 Windows update?
No. Microsoft designed the change, and its guidance says it’s a planned hardening step rather than a known issue. It follows a year of Audit-mode warnings that were meant to help administrators find affected connections.
Does this affect my home PC?
Probably not. The change applies to Windows 11 24H2 and later and Windows Server 2025 devices without Credential Guard, and it mainly hits domain-joined machines using MS-CHAPv2 single sign-on for Wi-Fi, Ethernet or VPN. If you connect to home Wi-Fi with a standard password, you’re unlikely to notice.
Should I uninstall the update to get back online?
We don’t recommend it. Setting BlockNtlmv1SSO to 0 restores the old behaviour without removing the other security fixes, and it’s easier to reverse once you’ve migrated. Ask your IT team before editing the registry on a managed work device.
