Windows: NTLMv1-derived credentials for SSO restricted by default (October 2026 update)
Since the October 2026 security update (released 2026-10-13), Windows 11 (26H2, 26H1, 25H2, 24H2) and Windows Server 2025 block the generation of NTLMv1-derived credentials for Single Sign-On by default. This applies only to devices with Credential Guard disabled and the BlockNtlmv1SSO registry value not set. Microsoft states this is a planned hardening change, not a known issue. The change is now live.
Microsoft · Windows
