October 2026 Windows Update Blocks NTLMv1 Single Sign-On Requests

Microsoft’s October 2026 Windows security update blocks Single Sign-On requests that rely on NTLMv1-derived credentials, a change that may disrupt network connectivity for some organizations. According to The Register, this enforcement is by design and aims to accelerate the removal of the deprecated legacy protocol from enterprise environments.

The update alters how Windows handles the BlockNtlmSSO registry value. If administrators have not explicitly set this value, the system now defaults to Enforce mode (1) rather than the previous Audit mode (0). This shift means that authentication attempts using NTLMv1-derived credentials are blocked immediately, which can impact Wi-Fi, Ethernet, and VPN connections in domain-joined environments.

Context and Background

This enforcement follows a multi-year deprecation timeline for NTLM. Microsoft added NTLM to its deprecation list in 2024 and introduced audit logs for NTLMv1 usage in late August 2025. The company stated in 2023 that its ultimate goal is eliminating the need for NTLM entirely. The protocol, which debuted with Windows NT 3.1 in 1993, is considered insecure by modern standards and has been removed from Windows 11 24H2 and Windows Server 2025.

Despite these removals, remnants of NTLM persist in specific configurations. The Register notes that issues may still arise when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2 and EAP-MSCHAPv2, within domain-joined setups. The October 2026 update highlights how migration away from this legacy technology is progressing, or lagging, across different organizations.

Who Is Affected

Enterprises that have not fully migrated away from NTLMv1 are most at risk. Administrators who relied on the previous Audit mode to monitor usage without blocking connections will now face immediate authentication failures for affected users. The Register reports that this could have major implications for networks still clinging to the long-deprecated security protocol.

Microsoft advises that while administrators can set the BlockNtlmSSO value to 0 to temporarily allow NTLMv1-derived Single Sign-On credentials, this reduces protection. The vendor stated that using Audit mode should only be considered a scoped, temporary security exception. The update does not automatically set the registry value, leaving the configuration responsibility with system administrators.

What should you do?

Administrators should review their network authentication logs to identify any remaining NTLMv1 usage. Those experiencing connectivity issues after the October 2026 update should check if their systems are relying on MS-CHAPv2-based connections. While reverting to Audit mode is possible, Microsoft recommends it only as a short-term fix while planning a full migration to more secure authentication methods.

What to do and how to stay safe: Microsoft

• Audit your network logs to identify any systems or users still authenticating via NTLMv1-derived credentials.
• Review Wi-Fi, Ethernet, and VPN configurations to ensure they do not rely on deprecated MS-CHAPv2 protocols.
• Test authentication flows in a isolated environment before deploying the October 2026 update broadly.
• Plan a migration strategy to replace legacy NTLM authentication with modern, supported protocols once the vendor provides an update.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does the October 2026 Windows update fix a security vulnerability?

No, the update is a planned enforcement of NTLMv1 deprecation, not a patch for a specific bug or vulnerability.

Can I disable the NTLMv1 blocking behavior?

Yes, administrators can set the BlockNtlmSSO registry value to 0 to revert to Audit mode, but Microsoft warns this reduces security.

Which Windows versions are affected by this change?

The change applies to Windows systems receiving the October 2026 update, particularly those still using NTLMv1 for Single Sign-On.