Microsoft's support page on NTLMv1 changes says that from October 13, 2026, Windows 11 blocks a legacy single sign-on method unless the PC has been told otherwise. It changes how some Wi-Fi, Ethernet and VPN connections sign in. A home router with a normal Wi-Fi password is not part of it. A laptop that joins a company or school network with a domain account probably is.
What changed on October 13
Windows has a setting called BlockNtlmv1SSO. It decides whether requests for credentials derived from NTLMv1, an old and weak authentication scheme, are only logged (value 0, "Audit") or refused (value 1, "Enforce"). Since September 2025 the default on Windows 11 24H2 and newer was to log. Microsoft says that with the October update, KB5127648, a PC that has no value set now behaves as if it were set to Enforce. The update does not write the value; it stays absent and the default flips.
Per Microsoft, the change does not take effect on a device with Windows Credential Guard turned on. It applies to Windows 11 24H2, 25H2 and 26H2.
Who may notice
The affected connections use MS-CHAPv2 authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. That is common on managed Wi-Fi at workplaces and schools, on some wired networks, and on some VPNs. With Enforce active, the automatic sign-in that reuses your Windows credentials can fail. Microsoft says typing the credentials by hand can still work, but they cannot be saved for next time.
The German outlet PC Games Hardware reported on October 16 that this mostly hits enterprise networks, that a full internet outage is not expected, and that Extreme Networks has reported failed PEAP authentications after the update. That is a report from one outlet and one network vendor. Microsoft's page does not list this as a known issue with the update; it describes a deliberate default change.
If you have a personal PC on a home network, a phone hotspot or a café network with a password or a sign-in page, nothing in Microsoft's description applies to you.
How to tell whether it is this
The signal Microsoft documents is in Event Viewer, under Applications and Services Logs, Microsoft, Windows, NTLM, Operational. Event ID 4025 is a blocked request in Enforce mode, an error. Event ID 4024 is the same request under Audit, logged and allowed, a warning. A 4025 that shows up at the moment the connection fails points to this change. Without it, the cause is probably something else, and the steps in Windows Wi-Fi keeps disconnecting are the place to start.
One caveat: a Wi-Fi network that fails to connect right after a Windows update has many possible causes. The event is evidence for this one; its absence does not tell you which other cause it is.
What the workaround is, and who should use it
Microsoft's documented workaround is to set the BlockNtlmv1SSO value to 0, which brings back Audit mode. The registry location is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. Microsoft calls it a temporary, scoped security exception that reduces protection, to be used only while the dependency is removed, and its page says a restart is not required.
On a work or school PC, that value is not yours to change; the network is run by someone who can choose to fix the network side. Microsoft's long-term advice is to remove the dependency on MS-CHAPv2, for example by moving to certificate-based authentication, or to enable Credential Guard where the hardware allows it. Both are decisions for whoever runs the network. If your laptop stopped joining the office Wi-Fi after October 13, the useful thing to send IT is the Event ID 4025 entry and the KB number.
What Microsoft has not said: how many networks depend on this, or whether it will adjust the default again. Its page describes the change as intended.
Where this sits among the October fixes
The same update also carries the AC-3 audio fix covered in Windows 11's AC-3 app crash is fixed; USB audio is not. That one is a bug fixed. This one is a default changed on purpose.
Another default Microsoft is changing this month is covered in Windows memory integrity turns on by itself this month, which says who is skipped and how to check yours.
Last updated October 19, 2026