Wi-Fi or VPN stopped connecting after the October 2026 Windows update: the NTLMv1 and MS-CHAPv2 change

What changed in October 2026

Microsoft’s KB5066470 explains that Windows has a setting called BlockNtlmv1SSO. Until October 2026, if nobody had set it, Windows only logged NTLMv1 single sign-on attempts (audit mode). Updates released on or after October 13, 2026 change that default to enforce: the attempt is blocked. The update doesn’t add the registry value itself; it just changes what Windows does when the value is missing.

Microsoft says MS-CHAPv2, the sign-in method behind PEAP-MSCHAPv2 and EAP-MSCHAPv2, is open to the same kinds of attack as NTLMv1, and the KB names Wi-Fi, Ethernet and VPN connections that use it on domain-joined PCs. That’s why networks where Windows signs you in with your domain account in the background are the ones that break. Microsoft’s message center notice about it (MC1508562) states that this is a planned hardening change, not a known issue with the October update.

Is your PC affected?

Condition	Affected?
Windows 11 24H2, 25H2, 26H1 or 26H2, or Windows Server 2025	In scope
Windows 10 or Windows 11 23H2	Not listed by Microsoft for this change
Credential Guard is running	No change: Credential Guard already blocked this sign-in
Credential Guard is off and BlockNtlmv1SSO isn’t set	Affected from the October 13, 2026 updates
Network uses certificates (EAP-TLS or PEAP-TLS) or a normal home Wi-Fi password	Not affected

To see whether Credential Guard is running, press Win + R, type msinfo32 and press Enter. On the System Summary page, look for Credential Guard in the Virtualization-based security Services Running line. Microsoft rolls the change out gradually, so two PCs on the same update may not switch at exactly the same time.

If you just need to get online

1. Select the Wi-Fi network or VPN again and choose Connect.
2. When Windows asks for credentials, type your work username and password yourself instead of relying on automatic sign-in.
3. Expect to repeat this: Microsoft’s Credential Guard documentation says you can still use these protocols by entering credentials, but you can’t save them for next time.

On a work or school PC, tell IT which network stopped connecting and when. Don’t change the registry yourself on a managed device; IT needs to decide how to handle it across the organization.

Confirm it in Event Viewer

Open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > NTLM > Operational. Microsoft lists two events:

• Event 4025 (Error): an NTLMv1 sign-in was blocked. This is the enforcement in action.
• Event 4024 (Warning): the attempt was allowed in audit mode. Seeing these before October tells IT which networks and servers depend on it.

Each event records the target server, the user, the domain and the process that asked, which is enough to find the RADIUS or VPN server involved.

For IT: the lasting fix

Microsoft’s guidance in the message center notice and the Credential Guard documentation is to stop using MS-CHAPv2 for network sign-in:

• Move Wi-Fi, 802.1X and VPN to certificates. Microsoft names PEAP-TLS or EAP-TLS. This needs a certificate on each device or user, usually issued through your PKI, Intune or Group Policy auto-enrollment, and a matching policy on the RADIUS or VPN server.
• Turn on Credential Guard where hardware allows. Microsoft recommends it on all supported platforms. It doesn’t make MS-CHAPv2 SSO work again, but it protects credentials, and the PC’s behaviour no longer depends on this default.
• Audit first. Use the 4024 and 4025 events to list every network that still relies on MS-CHAPv2 before you change it.

Microsoft is tightening network authentication step by step, as it did with SMB guest access, so planning a move to certificates is worth it even if the exception below gets you through this month.

For IT: the temporary exception

If a critical network can’t move yet, KB5066470 allows setting BlockNtlmv1SSO (a DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0) back to audit mode. 0 means audit (allow and log event 4024) and 1 means enforce (block and log event 4025). Microsoft says no restart is needed. From an elevated Command Prompt, check the current value, then set audit mode:

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v BlockNtlmv1SSO
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v BlockNtlmv1SSO /t REG_DWORD /d 0 /f

Microsoft describes this as a scoped, temporary security exception that lowers protection. Its notice advises documenting it, limiting how long it stays, watching for event 4024, and setting the value to 1 once the network has moved to certificates. Apply it only to the PCs that need it, not across the whole fleet. If you deploy it as a .reg file and it won’t import, see error accessing the registry.

What not to do

• Don’t uninstall the October update. It also contains other security fixes, and later updates bring the same default back.
• Don’t turn off Credential Guard. With Credential Guard on, this sign-in was already blocked, so turning it off fixes nothing and weakens the PC. If Credential Guard or memory integrity is off for driver reasons, see memory integrity and incompatible drivers.
• Don’t change other NTLM or LAN Manager settings to work around this. They aren’t part of Microsoft’s guidance for this change.

Related guides

• Your organization’s security policies block unauthenticated guest access: fix
• Memory integrity is off because of incompatible drivers: how to fix it
• Cannot import .reg file, error accessing the registry: how to fix it
• How to open Command Prompt as administrator in Windows 11 and 10

Official sources

• Manage NTLMv1 changes and prevent network authentication issues in Windows (KB5066470)
• Credential Guard considerations and known issues (Microsoft Learn)