Windows October update changes NTLMv1-derived SSO default: check MS-CHAPv2 Wi-Fi and VPN before users lose access

The change is narrower than a blanket NTLM shutdown

The October 2026 Windows security update changes an internal default that matters to organisations still using older network authentication. According to Microsoft’s KB5066470, an eligible device with Credential Guard disabled and no explicit BlockNtlmv1SSO registry value now blocks generation of NTLMv1-derived credentials for single sign-on (SSO). Previously, that unset state audited the request but allowed it. The update was released on 13 October; Microsoft highlighted the operational impact in its 14 October message-centre announcement and added the Windows 11 release-note detail on 15 October.

This is not a claim that all NTLM traffic is disabled or that every Wi-Fi or VPN connection fails. It concerns a particular SSO credential-generation path. Microsoft says manually entering credentials can still work in enforcement mode, but organisations should treat that as a diagnostic clue rather than their migration plan. The affected scenario is especially relevant to domain-joined Wi-Fi, wired Ethernet and VPN profiles that use MS-CHAPv2-based methods, including PEAP-MSCHAPv2 and EAP-MSCHAPv2.

Before and after: what an administrator will see

Default behaviour when BlockNtlmv1SSO is not set and Credential Guard is disabled, per Microsoft KB5066470.

Condition	Before October 2026 security update	After October 2026 security update
Internal default	Audit mode (0)	Enforce mode (1)
NTLMv1-derived SSO request	Audited and allowed	Blocked
Relevant NTLM Operational event	4024 warning	4025 error
Registry value	Not created by the default	Still not created or modified by the update
Possible user effect	Legacy MS-CHAPv2 SSO may connect automatically	Affected Wi-Fi, Ethernet or VPN SSO may fail

The empty registry value is easy to misread. Microsoft says the update changes the internal default, while the key itself remains absent. An administrator who checks only for a new value will miss the policy change. An explicit value of 0 selects Audit mode; an explicit 1 selects Enforce mode. This table is a direct comparison, so HTML is more accurate than a bar chart: there are states and conditions, not quantities.

Scoping decision for the October default change. Existing explicit policy and Credential Guard status must be checked on the device.

Device state	Does the changed unset default apply?	What to investigate
Credential Guard disabled; value absent	Yes	MS-CHAPv2 SSO dependence and Event ID 4025
Credential Guard disabled; value explicitly 0 or 1	No; explicit mode controls behaviour	Why the exception or enforcement was set
Credential Guard enabled	No; Credential Guard already constrains legacy credentials	Existing Credential Guard compatibility and network profile

Where network access can break and why

Microsoft had removed the NTLMv1 protocol from these newer Windows versions, yet remnants of NTLMv1-derived cryptography remained in some higher-level SSO flows. MS-CHAPv2 is the practical concern. A user who signs into Windows and expects automatic authentication to a PEAP-MSCHAPv2 Wi-Fi network or an EAP-MSCHAPv2 VPN may find the SSO path no longer produces the credential the network expects. The same question applies to relevant wired Ethernet profiles.

A failure after the update is not proof this hardening change caused it. Correlate the affected OS build, Credential Guard state, explicit registry policy, network profile and the NTLM Operational log. Microsoft identifies 4024 as the earlier audit warning and 4025 as an enforcement error. Check the event’s target, account and client-process context. Because access failures can be caused by certificate, RADIUS, driver or unrelated update issues, match these signals before changing policy.

A migration and troubleshooting order

Inventory network profiles that rely on MS-CHAPv2, then identify the subset of Windows 11 24H2/25H2/26H2 and Server 2025 devices where Credential Guard is disabled. Use historical 4024 audit events to find dependencies that were previously allowed. After updating, look for 4025 alongside actual connection failures. Pilot against the organisation’s Wi-Fi, Ethernet and VPN authentication paths rather than assuming all users share one profile.

Microsoft’s durable recommendation is to migrate from password-based MS-CHAPv2 methods to certificate-based approaches such as EAP-TLS or PEAP-TLS. That requires planning certificate issuance, renewal, trust, revocation and RADIUS policy, so it should be tested end to end. For a critical dependency that cannot be removed immediately, Microsoft documents a scoped, temporary BlockNtlmv1SSO=0 Audit exception. It reduces the new protection and should have an owner, expiry and migration plan. After the dependency is removed, restore enforcement. This report deliberately points administrators to KB5066470 for the precise registry guidance rather than suggesting a broad rollback of security updates.

A year of audit signals preceded the default switch

Microsoft KB5066470 was originally published in August 2025 and updated on 14 October 2026. Its chronology says Windows 11 24H2 and newer clients began receiving NTLMv1-derived credential auditing from late August 2025, with Windows Server 2025 following later that year. The 13 October 2026 security update changes the internal default for a specific unset-policy, Credential Guard-disabled condition from Audit to Enforce. This was a staged migration: administrators have had Event 4024 warnings to find dependencies before Event 4025 errors appear after enforcement.

The important distinction is that Microsoft had already removed the NTLMv1 protocol from Windows 11 24H2 and Server 2025. Certain higher-level single sign-on flows still used NTLMv1-derived cryptography even though the old protocol itself was gone. This update blocks those derived credentials in the scoped condition. Calling it a universal shutdown of NTLM, or assuming every MS-CHAPv2 deployment fails, would overstate the notice.

Microsoft's rollout chronology and what each date lets an administrator infer.

Period	Published behaviour	Practical interpretation
Late Aug 2025 onward	Audit capability begins on Windows 11 24H2 and newer clients	Collect Event 4024 where deployed; successful sign-in can still hide a dependency
Later 2025	Windows Server 2025 joins the staged rollout	Server fleet needs its own policy and event review
13 Oct 2026 update	Unset policy on eligible Credential Guard-disabled devices defaults to Enforce	Look for Event 4025 and affected SSO flows after installation

How to distinguish an SSO regression from a failed network service

A user saying 'the VPN is broken' is the start of diagnosis, not the conclusion. Microsoft's FAQ says manually entering credentials continues to work in Enforce mode, even where the automatic use of NTLMv1-derived credentials is blocked. If the user can connect after a manual credential prompt, that points towards the SSO dependency described in the notice. If the connection fails before authentication, or manual credentials also fail, investigate the access service, certificates, identity backend and ordinary network path as well.

Event 4024 is an Audit-mode warning: it records an attempted use of NTLMv1-derived credentials while allowing it. Event 4025 is an Enforce-mode error: the request was blocked. Microsoft places both under Microsoft-Windows-NTLM/Operational and includes a target server, user, client process and mechanism identifier. Correlate the event time with a specific Wi-Fi, Ethernet or VPN profile and its authentication method. The event is evidence of the credential path, not a diagnosis of every connectivity symptom.

A bounded diagnostic comparison based on Microsoft KB5066470.

Observation	Likely reading	Next check
4024 before update, connection succeeds	An SSO dependency was audited and allowed	Identify the affected profile and migration owner
4025 after update, automatic sign-in fails	Derived-credential SSO request blocked on an eligible device	Confirm OS build, Credential Guard state and explicit policy value
Manual credentials succeed	Network service works but automatic credential reuse may not	Review MS-CHAPv2 profile design and a replacement method
No relevant event; manual entry fails too	Different fault may be involved	Check access server, certificate, RADIUS and transport logs

Microsoft permits BlockNtlmv1SSO=0 as a temporary security exception when a critical dependency cannot immediately migrate. That setting deliberately restores Audit behaviour and lowers the protection gained from Enforce. It should have a named owner, limited device scope, an end date and monitoring of the continuing 4024 warnings. A broad permanent rollback would preserve the very legacy path the update is designed to remove. Microsoft recommends Credential Guard where supported, but its protections and deployment requirements are wider than this one default change; do not describe the registry exception as equivalent to enabling Credential Guard.

Primary sources

The behaviour, scope, event IDs and temporary exception are from Microsoft KB5066470, cross-checked against the October Windows 11 update note and Microsoft’s Credential Guard guidance. Read 16 October 2026.