/
← Voltar ao feed
medium

Microsoft's October 2026 Windows update enforces NTLMv1 SSO blocking by default, risking Wi-Fi, Ethernet and VPN authentication failures

1 fonte(s) · 1 atualização(ões) · publicado 16/10/2026 12:30 · coletado há 3 dias

The October 2026 Windows security update changes the default handling of NTLMv1-derived credentials for Single Sign-On. Before the update, Windows allowed them and logged warning events. Now they are blocked. Wi-Fi, Ethernet and VPN authentication may fail in environments that still depend on the legacy protocol. Microsoft states this is by design, and it is part of the effort to finalize the disablement of NTLMv1. This is not a vulnerability or an attack.

Detalhes técnicos

  • The behavior is controlled by the BlockNtlmSSO registry value. If it is unset, Windows now defaults to Enforce mode (1) instead of Audit mode (0). The update does not set the value itself.
  • Blocking applies when Credential Guard is not enabled and BlockNtlmSSO is not set to Audit mode (0).
  • NTLM was deprecated in 2024, and audit logs for NTLMv1 usage were added in late August 2025. NTLM has been removed from Windows 11 24H2 and Windows Server 2025, but remnants persist, notably in domain-joined environments using MS-CHAPv2-based connections (PEAP-MSCHAPv2, EAP-MSCHAPv2).
  • Microsoft said in September that in-market Windows versions will continue to support NTLM. Its long-term goal is a platform that needs no NTLM at all.

Remediação

  • Administrators can set BlockNtlmSSO to 0 (Audit mode) to temporarily allow NTLMv1-derived SSO credentials. Microsoft says this reduces protection and should be used only as a scoped, temporary security exception. The article does not say how long the workaround will remain available.
  • Use the NTLMv1 audit events to find remaining dependencies, and migrate away from NTLMv1 and MS-CHAPv2-based authentication.

Linha do tempo

  1. theregister.com ↗ · pub. 16/10/2026 12:30 · coletado 19/10 17:54 primeiro registro

    Microsoft's October 2026 Windows update enforces NTLMv1 SSO blocking by default, risking Wi-Fi, Ethernet and VPN authentication failures

    ler a análise desta fonte

    The October 2026 Windows security update changes the default handling of NTLMv1-derived credentials for Single Sign-On. Before the update, Windows allowed them and logged warning events. Now they are blocked. Wi-Fi, Ethernet and VPN authentication may fail in environments that still depend on the legacy protocol. Microsoft states this is by design, and it is part of the effort to finalize the disablement of NTLMv1. This is not a vulnerability or an attack.

    Technical Details

    • The behavior is controlled by the BlockNtlmSSO registry value. If it is unset, Windows now defaults to Enforce mode (1) instead of Audit mode (0). The update does not set the value itself.
    • Blocking applies when Credential Guard is not enabled and BlockNtlmSSO is not set to Audit mode (0).
    • NTLM was deprecated in 2024, and audit logs for NTLMv1 usage were added in late August 2025. NTLM has been removed from Windows 11 24H2 and Windows Server 2025, but remnants persist, notably in domain-joined environments using MS-CHAPv2-based connections (PEAP-MSCHAPv2, EAP-MSCHAPv2).
    • Microsoft said in September that in-market Windows versions will continue to support NTLM. Its long-term goal is a platform that needs no NTLM at all.

    Remediation

    • Administrators can set BlockNtlmSSO to 0 (Audit mode) to temporarily allow NTLMv1-derived SSO credentials. Microsoft says this reduces protection and should be used only as a scoped, temporary security exception. The article does not say how long the workaround will remain available.
    • Use the NTLMv1 audit events to find remaining dependencies, and migrate away from NTLMv1 and MS-CHAPv2-based authentication.