Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025

Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard

Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025, enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default. This planned security-hardening change is part of the boarder Microsoft effort to phase out NTLM and supported by Windows Credential Guard. This change applies only on devices with Credential Guard disabled, and might cause issues with Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, resulting in possible failure to connect via Single Sign-On pathways.

Organizations should identify affected authentication configurations. Remove dependencies on MS-CHAPv2 and migrate Wi-Fi and VPN connections to certificate-based authentication. As a temporary option, it is possible to temporarily make changes to the Windows registry that set affected devices to allow and audit these connections. After removing dependencies, devices should be returned to enforcement.

Please note this is a planned change in Windows that supports evolving security needs, originally documented in August 2025. It is not a known issue with the October 2026 security update.

For complete rollout, auditing, and registry configuration guidance, as well as help to identify and remove remaining dependencies on NTLMv1-derived credentials, carefully review KB5066470. Learn about the disablement of NTLM at Advancing Windows security: Disabling NTLM by default - Windows IT Pro Blog, Retiring NTLM: Frequently asked questions - Windows IT Pro Blog.

Introduction​

This article details changes in Windows 11, versions 26H2, 25H2, and 24H2 and Windows Server 2025, focusing on the auditing and enforcement of blocking NTLMv1-derived cryptography. These changes are part of the broader Microsoft initiative to phase out NTLM.

The October 2026 Windows security update introduces a change that strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. With this change, Windows uses Enforce mode (1) instead of Audit mode (0). This change applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication.

Background​

Microsoft has removed the NTLMv1 protocol (see Removed features and functionality) from Windows 11, version 24H2 and Windows Server 2025 and later versions. However, while the NTLMv1 protocol is removed, remnants of NTLMv1 cryptography are still present in some scenarios, such as when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2, in a domain-joined environment.

Beginning with Windows updates released in August 2025, Audit mode was introduced to help administrators identify dependencies on NTLMv1-derived credentials before enforcement.

Credential Guard provides complete protection of both NTLMv1 legacy cryptography and many other attack surfaces, and thus Microsoft strongly recommends its deployment and enablement if Credential Guard’s requirements are met. The changes outlined in this article only affect devices where Credential Guard is disabled; if Windows Credential Guard is enabled on the device, these changes do not take effect.

Goal​

With the deprecation of NTLM (see Deprecated features) and the removal of the NTLMv1 protocol, Microsoft is working to finalize the disablement of NTLMv1 by blocking the use of NTLMv1-derived credentials.

Changes​

Behavior before installing October 2026 Windows security update: Before installing the October 2026 Windows security update, released on October 13, 2026, when the BlockNtlmv1SSO registry value is not set, Windows uses Audit mode (0). Requests to use NTLMv1-derived credentials for Single Sign-On are audited but allowed, and warning events are generated.

Behavior after installing the October 2026 Windows security update: After installing the October 2026 Windows security update, released on October 13, 2026, when the BlockNtlmv1SSO registry value is not set; Windows uses Enforce mode (1) instead of Audit mode (0). The update does not create or modify the registry value. In Enforce mode, requests to use NTLMv1-derived credentials for Single Sign-On are blocked.

For a timeline of these changes, see the Rollout of changes section.

New registry key​

Windows updates released in August 2025 introduced a new registry key, BlockNtlmv1SSO, that controls whether the changes operate in Audit mode or Enforce mode.

Note: Administrators can configure BlockNtlmv1SSO either before or after installing the October 2026 Windows security update.


Beginning with the October 2026 Windows security update released on October 13, 2026, Enforce mode (1) becomes the internal default behavior on eligible devices when the BlockNTLMv1SSO registry value is not set.

Note that the default behavior change does not create or modify the registry value, which itself remains absent.

New auditing capabilities​

• When using Audit mode
  
  

  Event Log​	Microsoft-Windows-NTLM/Operational​
  Event Type	Warning
  Event Source	NTLM
  Event ID	4024
  Event Text	Auditing an attempt to use NTLMv1-derived credentials for Single Sign-On Target server: <domain_name> Supplied user: <user_name> Supplied domain: <domain_name> PID of client process: <process_identifier> Name of client process: <process_name> LUID of client process: <locally_unique_identifier> User identity of client process: <user_name> Domain name of user identity of client process: <domain_name> Mechanism OID: <object_identifier> For more information, see https:⁠//go.microsoft.com/fwlink/?linkid=2321802.

• When using Enforce mode
  
  

  Event Log​	Microsoft-Windows-NTLM/Operational​
  Event Type	Error
  Event Source	NTLM
  Event ID	4025
  Event Text	An attempt to use NTLMv1-derived credentials for Single Sign-On was blocked due to policy. Target server: <domain_name> Supplied user: <user_name> Supplied domain: <domain_name> PID of client process: <process_identifier> Name of client process: <process_name> LUID of client process: <locally_unique_identifier> User identity of client process: <user_name> Domain name of user identity of client process: <domain_name> Mechanism OID: <object_identifier> For more information, see https:⁠//go.microsoft.com/fwlink/?linkid=2321802.

For more information about other auditing enhancements, see Overview of NTLM auditing enhancements in Windows 11, version 24H2 and Windows Server 2025.

Rollout of changes​

In September 2025 and later updates, the changes were rolled out to Windows 11, version 24H2 and later versions in Audit mode. In this mode, Event ID: 4024 was logged whenever NTLMv1-derived credentials were used, but the authentication continued to work. The rollout reached Windows Server 2025 later in 2025.

Beginning with the October 2026 Windows security update, released on October 13, 2026, Microsoft strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows uses Enforce mode (1) instead of Audit mode (0).

In Enforce mode, requests to generate NTLMv1-derived credentials for Single Sign-On are blocked instead of only being audited.

This change might affect environments that still rely on NTLMv1-derived credentials for Single Sign-On, including certain Wi-Fi, Ethernet, and VPN authentication configurations that use MS-CHAPv2.

Timeline​

Preparing for Enforce mode​

Use the audit mode events described in this article to identify authentication flows that depend on NTLMv1-derived credentials before deploying the change broadly. Environments using MS-CHAPv2 Single Sign-On for Wi-Fi, Ethernet, or VPN authentication should be evaluated for potential dependencies.

Temporary security exception​

If an organization identifies a critical authentication dependency that cannot immediately be migrated, setting BlockNTLMv1SSO to 0 (Audit) temporarily allows NTLMv1-derived Single Sign-On credentials while remediation is completed.

Important: Using Audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception.

Frequently asked questions (FAQ)​

Q1: Why is there a difference between when client and servers get the changes?
Microsoft uses a gradual rollout method to distribute a release update over a period of time, rather than all at once. This means that users receive the updates at different times, and it might not be immediately available to all users.

Q2: Where are NTLMv1-derived credentials used?
NTLMv1-derived credentials are used by certain higher-level protocols for Single Sign-On purposes; examples include Wi-Fi, Ethernet, and VPN deployments using MS-CHAPv2 based authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. In Enforce mode, Single Sign-On flows that depend on NTLMv1-derived credentials are blocked. Manually entering credentials will continue to work in Enforce mode. For more information and best practices, see Considerations and known issues when using Credential Guard.⁠⁠

Q3: Are there other similarities between this update and Credential Guard?
The only similarity between this update and Credential Guard is protections around user credentials from NTLMv1-derived cryptography. This update does not provide the wide and robust protection of Credential Guard; Microsoft recommends Credential Guard enablement on all supported platforms.