A security change in Microsoft's October 2026 Windows update can stop a laptop joining the Wi-Fi network at a university, school or office. Microsoft classifies it as a planned change rather than a known issue, which keeps it off the release health page where people look when an update breaks something.
Home networks are not affected. The restriction only touches connections that authenticate with MS-CHAPv2, and a home router secured with a WPA2 or WPA3 passphrase does not use it.
The Windows message center entry, dated October 14, says the October 2026 security update enforces restrictions on generating NTLMv1-derived credentials for Single Sign-On by default. Microsoft adds that it "might cause issues with Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication".
What Microsoft changed on October 13
The mechanism is a single registry value most machines have never had set. Windows reads it to choose between Audit mode and Enforce mode, and until this month an unset value meant Audit.
Updates released on and after October 13, 2026 flip that internal default to Enforce. The supporting document, KB5066470, is explicit that the update does not create or modify the value itself.
That KB lists Windows 11 versions 26H2, 26H1, 25H2 and 24H2, plus Windows Server 2025. The message center entry names only three, because 26H1 was added to the KB on October 19, five days later.
One condition narrows all of this considerably. Microsoft states that if Credential Guard is enabled on the device, the changes do not take effect at all.
Why an NTLM change reaches MS-CHAPv2 Wi-Fi
NTLM is the authentication protocol Windows has carried for more than three decades, used mostly as a fallback when Kerberos is unavailable.
It "relies on weak cryptography, has no mutual authentication, and remains a leading vector for credential relay and pass-the-hash attacks", according to Microsoft's Windows IT Pro blog. A separate post lists replay and man-in-the-middle attacks among the risks.
The NTLMv1 protocol was already removed from Windows 11 24H2 and Windows Server 2025. Microsoft says remnants of NTLMv1 cryptography survive anyway, in MS-CHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2 on domain-joined networks.
That combination is how a great many institutional networks still authenticate. Microsoft's Credential Guard documentation says those MS-CHAPv2 endpoints are "subject to similar attacks as for NTLMv1".
Only single sign-on is blocked, which leaves one thing to try
Single Sign-On here means Windows reusing the password already supplied at the logon screen to authenticate to the network. That is the convenience that makes a managed laptop join the campus network silently at startup, and it is the specific path Enforce mode cuts.
The KB answers the obvious follow-up directly. "Manually entering credentials will continue to work in Enforce mode," it says.
Only SSO is blocked for MS-CHAP and NTLMv1, Microsoft's Credential Guard page adds, so the protocols still work when the user is prompted. Someone locked out may get back on by removing the saved network profile in Windows 11 and reconnecting, then typing the account name and password when asked.
How to check whether Credential Guard is on
Microsoft gives two methods and warns against a third. Looking for LsaIso.exe in Task Manager is not a recommended test.
Instead, open Start, type msinfo32.exe and select System Information. Under System Summary, Credential Guard should appear next to "Virtualization-based Security Services Running".
An elevated PowerShell session answers the same question with a query against the Win32_DeviceGuard class, where 0 means disabled and 1 means running. Credential Guard has been on by default since Windows 11 22H2 on eligible Enterprise and Education devices, and on some Pro licenses, unless an administrator explicitly turned it off.
The registry option is temporary, and the real fix is not a user's to make
The value is BlockNtlmv1SSO, a REG_DWORD at HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsamsv1_0. Setting it to 0 restores Audit mode, 1 is Enforce, and no restart is required.
Microsoft files that under the heading "Temporary security exception". Audit mode "reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception", the KB says.
Audit mode writes warning Event ID 4024 to the Microsoft-Windows-NTLM/Operational log each time NTLMv1-derived credentials are used, naming the user and the client process. Enforce mode writes error 4025 when a request is blocked.
Those 4024 warnings are not new. Microsoft introduced the registry value in August 2025 and rolled Audit mode out to Windows 11 24H2 and later from September 2025.
Roughly fourteen months of warnings preceded the switch that arrived with October's cumulative update.
The permanent answer, per the message center entry and the Credential Guard documentation, is moving the network off MS-CHAPv2 to certificate-based authentication such as PEAP-TLS or EAP-TLS. That is a change to the authentication server, not to a laptop, so on a managed network it is not something an individual can do.
For most affected readers the honest advice is to report it to whoever runs the network, since the registry edit needs administrator rights and weakens the protection the update added.
Microsoft publishes no figure for how many devices are caught by this, and names only Cisco ISE as a common enterprise MS-CHAPv2 implementation. It also sets no end date for the escape hatch.
The KB says the setting is supported throughout the normal lifecycle of these Windows versions, with no current plans to remove it, even while calling its use temporary.
Discussion (0)
Be the first to comment.