Networking problems after the October 2026 Windows update? NTLM might be to blame
Legacy protocol is going to be axed, and enforcement by default will highlight how migration is going
The October 2026 Windows security update may disrupt network connections for certain users who continue to rely on outdated NTLMv1 security protocols. Although the update is not an error, it is a deliberate move by Microsoft to phase out this legacy technology. NTLMv1 was first introduced in 1993 with Windows NT 3.1 and was phased out in Windows 11 24H2 and Windows Server 2025, but some remnants still exist in certain connections, such as PEAP-MSCHAPv2 and EAP-MSCHAPv2 in a domain environment.
After the update, requests to utilize NTLMv1-derived credentials are barred. The reason for this lies in the BlockNtlmSSO registry value. If it has not been set, Windows will now operate in Enforce mode (1) rather than Audit mode (0), thereby blocking these requests and potentially impacting Wi-Fi, Ethernet, and VPN authentication, and consequently, connections.
The update does not automatically set the BlockNtlmSSO value, but administrators can temporarily permit NTLMv1-derived Single Sign-On credentials by setting it to 0.
Microsoft advises against using Audit mode, stating that it only provides partial protection compared to Enforce mode and should only be used as a temporary security exception. This is not a bug, but a deliberate design decision, as Microsoft has been working towards eliminating the need for NTLM entirely. The company made this clear in 2023, stating that its ultimate goal is to do away with NTLM altogether.
However, NTLM still exists in the operating system for the time being but is on its way out and will be phased out in a future Windows release.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
