Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard
Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025, enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default. This planned security-hardening change is part of the boarder Microsoft effort to phase out NTLM and supported by Windows Credential Guard. This change applies only on devices with Credential Guard disabled, and might cause issues with Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, resulting in possible failure to connect via Single Sign-On pathways.
Organizations should identify affected authentication configurations. Remove dependencies on MS-CHAPv2 and migrate Wi-Fi and VPN connections to certificate-based authentication. As a temporary option, it is possible to temporarily make changes to the Windows registry that set affected devices to allow and audit these connections. After removing dependencies, devices should be returned to enforcement.
Please note this is a planned change in Windows that supports evolving security needs, originally documented in August 2025. It is not a known issue with the October 2026 security update.
Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025 | Microsoft Support
Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025, enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default. This planned security-hardening change is part of the boarder Microsoft effort to phase out NTLM and supported by Windows Credential Guard. This change applies only on devices with Credential Guard disabled, and might cause issues with Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, resulting in possible failure to connect via Single Sign-On pathways.
Organizations should identify affected authentication configurations. Remove dependencies on MS-CHAPv2 and migrate Wi-Fi and VPN connections to certificate-based authentication. As a temporary option, it is possible to temporarily make changes to the Windows registry that set affected devices to allow and audit these connections. After removing dependencies, devices should be returned to enforcement.
Please note this is a planned change in Windows that supports evolving security needs, originally documented in August 2025. It is not a known issue with the October 2026 security update.
Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025 | Microsoft Support