IT SBIT Services
Schneeberger
DEEN
Known update issues

Windows 11 KB5127648: 802.1X/PEAP Wi-Fi and wired authentication fails

WorkaroundKnown issueCommunity report

← All entries

Community report – not yet confirmed by the vendor: users or trade media report on it (forums, Q&A sites, Reddit, web research), but the vendor has not confirmed the issue (yet). Use this information with caution.

Summary

After installing KB5127648, Windows 11 clients reportedly fail to authenticate on WPA2-Enterprise Wi-Fi and wired 802.1X networks using PEAP (Protected Extensible Authentication Protocol). This is reported by users, not yet confirmed by the vendor. A likely cause, inferred and not listed by Microsoft, is that NTLMv1 single sign-on is now blocked by default. Reported mitigations exist, but no vendor fix is known.

Symptoms

Affected clients show 'Connected, not authenticated' on Wi-Fi (WPA2-Enterprise) and on wired 802.1X connections using PEAP/MS-CHAPv2. VPN authentication is also reported as affected in one source. Some admins report rollbacks and paused deployment rings.

Affected

  • Windows 11 24H2, 25H2 and 26H2 with KB5127648 (released 2026-10-13)
  • Networks using 802.1X with PEAP/MS-CHAPv2 (Wi-Fi, wired, reportedly VPN)

Workaround

Reported by users, not documented by Microsoft:

  1. Set the BlockNtlmv1SSO value to 0 (the cause is assumed to be that it defaults to Enforce when unset). Test on a pilot device first.
  2. Alternatively, uninstall KB5127648 on affected devices.
  3. Long term, move to certificate-based authentication (for example EAP-TLS).

Fix

Not fixed yet. No vendor statement is available.

Recommendation

Pause rollout of KB5127648 to devices that use 802.1X PEAP/MS-CHAPv2 and test on a pilot group first. If devices are already affected, apply the reported mitigation to a few devices and verify. Plan the migration to certificate-based authentication, and watch for an official Microsoft statement.

Reports from the community and trade media

Reports from forums, Q&A sites, Reddit and trade media – linked only, without the names of the authors; the vendor’s statement is authoritative.

Sources

Compiled from community reports and web research and translated with AI (Claude) – not yet confirmed by the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 17:04.

Where the information comes from

We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:

  • Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
  • other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
  • community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
  • targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
  • early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online

Summary and translation with AI (Claude by Anthropic) – without any data of visitors.

Affected? We can help.

We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.

Get in touchRSS feed