Networking problems after the October 2026 Windows update? NTLM might be to blame

What changes in October

Before the October 2026 security update, Windows allowed NTLMv1-derived credentials for Single Sign-On and generated warning events. Afterward, requests to use those credentials are blocked. The behavior depends on the BlockNtlmSSO registry value. If it is unset, Windows uses Enforce mode, value 1, rather than Audit mode, value 0. This can affect authentication over Wi-Fi, Ethernet and VPN connections.

A temporary administrator option

The update does not set BlockNtlmSSO. Administrators can set the value to 0 to temporarily allow NTLMv1-derived Single Sign-On credentials. Microsoft warns that Audit mode offers less protection than Enforce mode and should be used only as a limited, temporary security exception. How long this workaround will remain available is unclear; it may last until the next major Windows release.

A difficult protocol to retire

NTLM dates to 1993, when it appeared with Windows NT 3.1. Despite being considered insecure by modern standards, removing it from enterprise environments has proved difficult. Microsoft removed NTLM from Windows 11 24H2 and Windows Server 2025, but remnants remain, including in domain-joined environments using MS-CHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2. Audit mode was introduced in 2025 to help administrators identify continued use.

Migration remains the concern

Microsoft said in September that current Windows client and Windows Server versions would continue to support NTLM. The company also described its long-term goal as a Windows platform that does not need the protocol.

Networking failures after the October update could indicate that migration plans are not as advanced or complete as administrators believed. The new default enforcement may make remaining dependencies more visible.