Microsoft Explains NTLMv1 SSO Shift Behind KB5127648 Auth Failures

Microsoft on October 14, 2026 updated its Windows Message Center to explain why some Wi-Fi, wired LAN and VPN connections fail authentication after installing the October 2026 security update KB5127648. According to forest.watch.impress.co.jp, the failures stem from a planned shift in default behavior, not from a faulty patch.

In Windows 11 versions 26H2, 25H2 and 24H2, as well as in Windows Server 2025, generating NTLMv1-derived credentials for single sign-on is now restricted by default, moving from audit mode to enforcement mode. The change applies to devices where Credential Guard is disabled and the registry value BlockNtlmv1SSO is not set.

Under audit mode (registry value 0), SSO with NTLMv1-derived credentials is allowed and a warning event 4024 is logged. Under enforcement mode (registry value 1), such SSO is blocked and error event 4025 is logged. The update does not create or modify the registry value itself; only the internal default behavior applied when the value is unset changes from audit mode to enforcement mode.

Checking dependencies and temporary options

Microsoft urges eliminating dependence on MS-CHAPv2 and migrating Wi-Fi and VPN connections to certificate-based authentication. Dependencies can be checked using the event log Microsoft-Windows-NTLM/Operational.

As a temporary exception, setting the registry value BlockNtlmv1SSO to 0 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 allows NTLMv1-derived SSO without a reboot. The NTLMv1 protocol itself was already removed in Windows 11 version 24H2 and Windows Server 2025, but its cryptography is still used in some scenarios such as MS-CHAPv2-based connections in domain-joined environments. The deprecation of NTLM and migration to Kerberos in Windows 11 and Windows Server 2025 has been progressing in stages, and this change had been planned and announced in advance.