Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard

Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025 enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default. This planned security-hardening change is part of the boarder Microsoft effort to phase out NTLM. Microsoft originally documented the change in August 2025. This change applies only on devices with Credential Guard disabled, and might cause issues with Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, resulting in possible failure to connect via Single Sign-On pathways. Windows uses a registry configuration to control whether requests for NTLMv1-derived credentials are audited or blocked. The configuration includes a registry key named BlockNtlmv1SSO. Beginning with the October 2026 security update, Windows uses Enforce mode as the internal default behavior instead of Audit mode, if the registry key BlockNtlmv1SSO has not been previously configured. If the registry key BlockNtlmv1SSO has not been previously configured. Please note this is a planned change in Windows which supports evolving security needs. It is not a known issue with the October 2026 security update. To learn about changes to NTLMv1 in Windows, see KB5066470. Rollout schedule Microsoft enabled auditing of NTLMv1-derived credential use on Windows 11, version 24H2 and later versions, starting in late August 2025. The rollout to Windows Server 2025 began in November 2025. Beginning with the October 2026 security update, the default system behavior changes from audit of NTLMv1 connections to enforcing security by restricting NTLMv1 connections. This default change applies only when administrators have not already configured the BlockNtlmv1SSO registry value on the device. Impact on your organization Devices running Windows 11, version 24H2 and later versions, or Windows Server 2025, might be affected when Credential Guard is disabled and network authentication depends on NTLMv1-derived credentials. In Enforce mode, Windows blocks requests to generate NTLMv1-derived credentials. Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2, for Single Sign-On might consequently fail to connect automatically. Manually entering credentials can continue to work, but credentials cannot be saved for future use in these scenarios. As a result, workflows that previously established […]

The post Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard appeared first on M365 Admin.