Windows: NTLMv1-derived credentials for SSO restricted by default (October 2026 update)
Summary
Since the October 2026 security update (released 2026-10-13), Windows 11 (26H2, 26H1, 25H2, 24H2) and Windows Server 2025 block the generation of NTLMv1-derived credentials for Single Sign-On by default. This applies only to devices with Credential Guard disabled and the BlockNtlmv1SSO registry value not set. Microsoft states this is a planned hardening change, not a known issue. The change is now live.
What changes?
Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2 authentication (PEAP-MSCHAPv2, EAP-MSCHAPv2) in domain-joined environments may fail to connect via Single Sign-On. Blocked requests log Error Event ID 4025 in Microsoft-Windows-NTLM/Operational; in Audit mode Warning Event ID 4024 is logged.
Affected
- Windows 11, versions 26H2, 26H1, 25H2 and 24H2
- Windows Server 2025
- Only devices with Credential Guard disabled and BlockNtlmv1SSO not set
- Connections using MS-CHAPv2 (Wi-Fi, Ethernet, VPN)
- Reference: KB5066470
Preparation and temporary exceptions
- Identify affected authentication configurations (check Event ID 4024/4025 in Microsoft-Windows-NTLM/Operational).
- Remove dependencies on MS-CHAPv2 and migrate Wi-Fi and VPN connections to certificate-based authentication.
- As a temporary option, set the registry value BlockNtlmv1SSO (REG_DWORD) under HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\msv1_0 to 0 (Audit mode: allowed and audited). No restart is required.
- After removing dependencies, return devices to enforcement (value 1 or remove the temporary setting).
Check and complete
Not a defect, so no fix is planned. Enforcement is intended; remove the dependencies on NTLMv1-derived credentials or enable Credential Guard (see KB5066470).
Recommendation
Check Wi-Fi and VPN connections for MS-CHAPv2 now, especially on devices without Credential Guard, and review Event IDs 4024/4025. Migrate to certificate-based authentication and enable Credential Guard where requirements are met. Use Audit mode (0) only temporarily as a stopgap.
Timeline
- Audit mode introduced: NTLMv1 usage is logged (Event ID 4024) on Windows 11 24H2 and later, authentication still works.
- The October 2026 security update changes the default to Enforce mode (1) when the BlockNtlmv1SSO registry value is not set and Credential Guard is disabled.
Fix script (PowerShell)
Windows: NTLMv1-derived SSO credentials blocked by default after October 2026 update
- What it does
- Prevents Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2 single sign-on from failing once Windows enforces the NTLMv1 block by default. It temporarily sets Audit mode so these connections are allowed and logged until the dependencies are removed.
- How it does it
- The script sets HKLM\SYSTEM\currentcontrolset\control\lsa\msv1_0\BlockNtlmv1SSO to the DWord value 0 (Audit mode). It first backs up the current value, runs as a dry run by default and can be reverted with -Undo. It is a temporary exception only: return to enforcement (value 1 or remove the value) once the dependencies are gone.
Warning: the script changes a security-relevant setting (LSA / NTLM / credential protection). It is the workaround documented by the vendor, usually temporary – once the issue is fixed, run the script again and restore the previous configuration (or use -Undo).
How to use it
- Download it and check its content and SHA-256.
- Run it in PowerShell without parameters (as administrator if required): first it checks whether the system is affected ("AFFECTED", "NOT AFFECTED" or "UNCLEAR"), then it shows the planned changes (old → new) and asks "Apply changes now?". Before that it backs up every affected value; without a backup it changes nothing.
.\ITSB-Fix-ntlmv1-derived-credentials-for-sso-restricted-by-default-fro-v2.ps1 - To undo, run the script again: it asks "Restore previous configuration?" and restores exactly the state before the first change (values that did not exist before are removed again).
.\ITSB-Fix-ntlmv1-derived-credentials-for-sso-restricted-by-default-fro-v2.ps1 - Without a user (Intune, RMM, scheduled tasks) it never prompts: without parameters it only checks (-Check), -Apply backs up and changes, -Undo restores, -Apply -Force also when "not affected". Exit codes: 0 done, 1 error, 2 no backup, 3 cancelled, 4 not affected. Log and backup in %ProgramData%\ITSB\Fixes.
.\ITSB-Fix-ntlmv1-derived-credentials-for-sso-restricted-by-default-fro-v2.ps1 -Check·.\ITSB-Fix-ntlmv1-derived-credentials-for-sso-restricted-by-default-fro-v2.ps1 -Apply·.\ITSB-Fix-ntlmv1-derived-credentials-for-sso-restricted-by-default-fro-v2.ps1 -Undo·.\ITSB-Fix-ntlmv1-derived-credentials-for-sso-restricted-by-default-fro-v2.ps1 -Apply -Force
Use at your own risk – no warranty, no liability if anything does not work or is wrong. Test before use and make a backup. Our terms and conditions (free scripts) apply. Generated automatically from the vendor’s statement and checked (rules, second AI review).
Sources
- KB5066470: Manage NTLMv1 changes and prevent network authentication issues in Windows Vendor · support.microsoft.com
- Advancing Windows security: Disabling NTLM by default Vendor · techcommunity.microsoft.com
- Retiring NTLM: Frequently asked questions Vendor · techcommunity.microsoft.com
- Credential Guard: Wi-Fi and VPN considerations Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 17:15.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.