Networking problems after the October 2026 Windows update? NTLM might be to blame

REG AD

Legacy protocol is going to be axed, and enforcement by default will highlight how migration is going

The October 2026 Windows security update may break networking for some customers who are still clinging to long-deprecated NTLMv1 security.

A seemingly minor change in the update could have major implications for administrators and enterprises that haven't fully moved away from the legacy technology.

Before the October 2026 update, Windows permitted NTLMv1-derived credentials for Single Sign-On and generated warning events. After the update, requests to use NTLMv1-derived credentials are blocked.

It comes down to the BlockNtlmSSO registry value. If it hasn't been set, Windows will now use Enforce mode (1) instead of Audit mode (0), thus blocking requests and potentially impacting Wi-Fi, Ethernet, and VPN authentication, and therefore connections.

The update does not set the value of BlockNtlmSSO, and administrators can set it to 0 to temporarily allow NTLMv1-derived Single Sign-On credentials. However, Microsoft noted, "Using Audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception."

To be clear, this is not a bug and is by design. The addition of NTLM to the deprecation list occurred in 2024, and Microsoft added audit logs for NTLMv1 usage in late August 2025. The Windows giant has made no secret of its desire to ditch the legacy technology, stating in 2023, "Our end goal is eliminating the need to use NTLM at all."

The problem is NTLM's longevity. It appeared in 1993 with Windows NT 3.1, and removing it from enterprise environments has proven tricky, even though it is somewhat insecure by modern standards. Microsoft removed it from Windows 11 24H2 and Windows Server 2025, but some remnants can still be found, notably when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2, in a domain-joined environment.

Hence the introduction of the audit mode in 2025, to help administrators spot where the technology was still being used.

It is now 2026, and Microsoft has taken the next step. If Credential Guard is not enabled and BlockNtlmSSO is not set to Audit mode (0), the use of NTLMv1-derived credentials will be blocked as Microsoft works "to finalize the disablement of NTLMv1."

There is no indication of how long the BlockNtlmSSO workaround (setting the value to Audit mode) will work - most likely until the next major Windows release. In September, Microsoft said, "In-market versions of Windows client and Windows Server will continue to support NTLM." However, it also stated, "Our long-term objective is a Windows platform that doesn't need NTLM at all."

As such, if the message wasn't already clear, the move to enforce it by default makes it impossible to miss. The technology still exists in the operating system, but it is on its way out and will be removed in a future Windows release.

Problems with networking after the October 2026 Windows security update could therefore signal that migration plans are not as far along, or as complete, as administrators might have thought. ®