Microsoft’s October 13, 2026, Windows 11 update KB5127648 changes how some single sign-on (SSO) requests using NTLMv1-derived credentials are handled. On systems where Credential Guard is disabled and the BlockNtlmv1SSO registry value is absent, the default changes from Audit to Enforce. Microsoft says certain Wi-Fi, Ethernet, and VPN connections using MS-CHAPv2-based SSO may be affected. Microsoft’s release notes and NTLMv1 guidance describe the change and its conditions.
Which Windows 11 systems are affected by the change?
Microsoft lists KB5127648 for all editions of Windows 11 versions 24H2, 25H2, and 26H2. The corresponding builds are 26100.9711, 26200.9711, and 26300.9711. The NTLMv1 default change applies when Credential Guard is off and BlockNtlmv1SSO has not been configured; the update does not create or change that registry value.
The affected path involves NTLMv1-derived credentials used for SSO with MS-CHAPv2 authentication. Microsoft cites PEAP-MSCHAPv2 and EAP-MSCHAPv2 scenarios, which can be used with enterprise Wi-Fi, Ethernet, or VPN connections. The possible impact therefore depends on both the device’s settings and its authentication method.
An administrator on Microsoft Q&A reported that WPA2-Enterprise 802.1X/PEAP authentication stopped completing after KB5127648, while WPA2-Personal continued to work. The administrator said removing the update restored connectivity. Other participants reported that setting BlockNtlmv1SSO to 0 restored connections in their environments. Those are individual reports from Microsoft Q&A.
What Audit, Enforce, and the event IDs mean
Microsoft identifies BlockNtlmv1SSO as a REG_DWORD at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. Its value determines whether Windows logs and allows the relevant credential request or blocks it.
| Mode | BlockNtlmv1SSO value | Request behavior | Event ID |
| Audit | 0 | Logged and allowed | 4024, warning |
| Enforce | 1 | Blocked | 4025, error |
On an eligible device with the value absent, KB5127648 uses Enforce as the internal default. Microsoft says changing the value does not require a restart. Its guidance also says manually entering credentials continues to work in Enforce mode.
Audit is a security exception, not the default to keep
Setting the value to 0 selects Audit mode: Windows records the NTLMv1-derived SSO request but allows it. Microsoft warns that Audit provides less protection than Enforce and should be a scoped, temporary security exception. The setting may restore an affected connection in some reported environments, but it also changes how that credential request is handled.
The separate Always On VPN fix
KB5127648 also fixes an Always On VPN connection problem that followed KB5124008 when automatic protocol selection or fallback was configured. That is separate from the possible effect on MS-CHAPv2-based VPN SSO: the update can address one specific Always On VPN scenario while changing the default for a different authentication path.
Microsoft’s October update notes also added a separate Remote Desktop connection issue; NeoTeo covered that notice in its earlier report.
