Windows October 2026 update blocks NTLMv1 SSO by default, risking network access

Microsoft’s October 2026 Windows security update introduces a default enforcement of NTLMv1 restrictions for Single Sign-On requests, according to The Register. This change affects organisations that have not fully migrated away from the legacy authentication protocol. Before this update, Windows permitted these credentials while generating warning events; now, such requests are blocked entirely.

Root cause

The shift stems from the BlockNtlmSSO registry value. If this value has not been explicitly set by administrators, Windows now defaults to Enforce mode rather than Audit mode. This design decision reflects Microsoft’s broader strategy to eliminate NTLM usage, a protocol that has been on the deprecation list since 2024. The company added audit logs for NTLMv1 usage in late August 2025 to prepare for this enforcement.

Attack path

NTLMv1 is considered insecure by modern standards, having appeared with Windows NT 3.1 in 1993. While Microsoft removed the protocol from Windows 11 24H2 and Windows Server 2025, remnants persist in certain configurations. Specifically, MS-CHAPv2-based connections, including PEAP-MSCHAPv2 and EAP-MSCHAPv2, can still trigger reliance on NTLM in domain-joined environments, creating a vector for authentication failures under the new rules.

Affected versions

• Windows clients and servers running the October 2026 security update.
• Systems where the BlockNtlmSSO registry value has not been manually configured.
• Domain-joined environments utilising MS-CHAPv2-based authentication methods.

Mitigation

• Verify the current state of the BlockNtlmSSO registry value on critical systems.
• Identify any infrastructure relying on NTLMv1-derived Single Sign-On credentials.
• Plan a migration to modern authentication protocols to avoid future disruptions.
• Monitor audit logs for any residual NTLMv1 usage attempts post-update.

What it means for organisations

Teams usually need to assess their authentication infrastructure immediately after such a policy shift. Check whether legacy protocols are still embedded in network access controls or remote access solutions. Identify which departments rely on older authentication methods and notify them of potential connectivity interruptions. Engage with security vendors to ensure their solutions align with modern standards. Review internal documentation to update incident response plans for authentication failures. Ensure that change management processes are updated to reflect these new security baselines.

What to do and how to stay safe: Microsoft

• Audit network devices and endpoints for dependencies on NTLMv1 authentication.
• Review VPN and Wi-Fi configurations for MS-CHAPv2 usage in domain-joined setups.
• Consult with security teams to plan a phased migration to secure protocols.
• Monitor system logs for authentication failures following the update deployment.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Can I disable the NTLMv1 block in the October 2026 update?

Yes, administrators can set the BlockNtlmSSO registry value to 0 to allow NTLMv1-derived credentials temporarily, though Microsoft advises this only as a scoped exception.

Is this a bug or an intentional change?

This is an intentional change by design, part of Microsoft’s long-term goal to eliminate the need for NTLM authentication entirely.

Which authentication methods are affected?

NTLMv1-derived credentials for Single Sign-On are blocked, impacting Wi-Fi, Ethernet, and VPN authentication, particularly those using MS-CHAPv2-based connections.