Microsoft's Oct 23 security post highlights a Windows change that took effect with updates released on Oct 13, 2026: on eligible devices, an unset BlockNtlmv1SSO value now defaults to Enforce instead of Audit. Organizations that use MS-CHAPv2-based single sign-on for Wi-Fi, wired Ethernet, or VPN should check their endpoint and network policies before the next broad update wave.
BlockNtlmv1SSO is absent. It blocks NTLMv1-derived credentials used for SSO; manually entered credentials can still work.What changed in the October update
Since 2025, Windows has audited attempts to use NTLMv1-derived credentials for SSO. Beginning with the Oct 13, 2026 security updates, Microsoft changed the internal default to Enforce when the registry value has not been configured. The update does not create or modify the registry value; a value already set to 0 or 1 remains an explicit policy choice.
| Device state | Behavior after the October update | Operational meaning |
|---|---|---|
| Credential Guard disabled; value absent | Enforce mode | NTLMv1-derived SSO requests are blocked. |
BlockNtlmv1SSO = 0 | Audit mode | Requests are allowed and warning events are logged. |
BlockNtlmv1SSO = 1 | Enforce mode | Requests are blocked and error events are logged. |
| Credential Guard enabled | The default-value change does not apply | Credential Guard can independently block similar SSO flows; review its separate compatibility guidance. |
Microsoft lists Windows 11 versions 24H2, 25H2, 26H1, and 26H2, plus Windows Server 2025. Devices outside those supported versions are not in scope of this particular default change.
Where users may notice it
Some domain-joined Wi-Fi, Ethernet, and VPN connections use MS-CHAPv2-based authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. If a flow relies on Windows generating NTLMv1-derived credentials for SSO, automatic connection can fail after the default changes. A user may still connect by entering credentials manually, which can make a break appear intermittent or user-specific.
Credential Guard-enabled devices are not affected by this new default switch because Credential Guard already prevents NTLMv1 SSO. Microsoft separately recommends moving MS-CHAPv2 Wi-Fi and VPN connections to certificate-based authentication such as EAP-TLS or PEAP-TLS. Test that change carefully because Credential Guard has its own compatibility considerations.
Find evidence in Windows event logs
On devices in Audit mode, review Microsoft-Windows-NTLM/Operational for warning event 4024, which records attempts to use NTLMv1-derived credentials for SSO. In Enforce mode, event 4025 is an error logged when Windows blocks such an attempt. The event includes the target, user and process details that help assign remediation to the right application or network owner.
- Inventory scope. Identify Windows 11 24H2 and later clients plus Windows Server 2025. Record update status, Credential Guard state, and whether the registry value exists or is explicitly configured.
- Centralize the signals. Search retained NTLM/Operational logs for 4024 and 4025. Use pre-change audit events to find dependencies; on devices already enforcing, look for 4025 and correlate with Wi-Fi, switch, VPN, and help-desk records.
- Map each authentication path. Ask network and identity owners which SSIDs, wired access policies, and VPN profiles use PEAP-MSCHAPv2, EAP-MSCHAPv2, or another MS-CHAPv2 flow. Test with representative managed devices and user groups.
- Move to a durable method. Plan a pilot to certificate-based EAP-TLS or PEAP-TLS, or another modern authentication method supported by the network platform. Confirm the RADIUS, certificate enrollment, device policy, and recovery paths before rollout.
- Verify the result. Test automatic reconnect after sign-out, reboot, password changes, VPN reconnects, and roaming. Confirm the expected authentication method at the network edge and monitor for new 4025 events.
Use Audit mode only as a time-bound exception
If a critical service cannot be migrated immediately, Microsoft documents setting BlockNtlmv1SSO to 0 to temporarily allow the SSO request while it is audited. The registry path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0; the value is a DWORD, and Microsoft says a restart is not required after changing it.
Frequently asked questions
Does the update disable all NTLM authentication? No. It changes handling of NTLMv1-derived credentials used for single sign-on when the value is absent on eligible devices. It is not a general shutdown of every NTLM version or every Windows network logon.
Can users still connect if SSO is blocked? Microsoft says manually entering credentials continues to work in Enforce mode. That is a workaround for the immediate connection, not a durable fix for an MS-CHAPv2 dependency.
What do events 4024 and 4025 mean? Event 4024 is a warning for an audited NTLMv1-derived SSO attempt. Event 4025 is an error for an attempt blocked in Enforce mode. Both appear in Microsoft-Windows-NTLM/Operational.
Can we set BlockNtlmv1SSO to 0? Microsoft documents 0 as temporary Audit mode when a critical dependency cannot be migrated immediately. It reduces protection, needs a scoped owner and expiry, and does not require a restart after the change.
Need help with the operational plan?
Accred Consulting helps organizations turn Microsoft security and infrastructure changes into a scoped implementation plan, with ownership and verification steps.
Plan a Security Review