Microsoft's October 2026 Windows security update has begun blocking network authentication for organizations still using the decades-old NTLMv1 protocol, according to an October 16, 2026 report from The Register. The change marks a major step in the company's multi-year effort to eliminate the legacy technology from Windows entirely. Administrators who haven't completed their migration away from the protocol may find users suddenly unable to connect to Wi-Fi, Ethernet, or VPN networks.
Before the October update, Windows allowed NTLMv1-derived credentials for single sign-on and created warning logs. After the update, those same requests are now refused. The shift happens through a registry setting called BlockNtlmSSO: if it hasn't been manually configured, Windows now defaults to Enforce mode (a value of 1) rather than Audit mode (a value of 0), which stops the requests and can disrupt authentication for wireless, wired, and virtual private network connections. Microsoft doesn't set the BlockNtlmSSO value itself, and system administrators can change it to 0 to temporarily permit NTLMv1-derived single sign-on credentials. The protocol still appears in Windows when MS-CHAPv2-based connections are used—including PEAP-MSCHAPv2 and EAP-MSCHAPv2—in environments where machines are joined to a domain.
The change is intentional, not a defect. Microsoft added NTLM to its deprecation list in 2024, introduced audit logs for NTLMv1 usage in late August 2025, and stated in 2023 that "our end goal is eliminating the need to use NTLM at all." According to the report, Microsoft warned in its documentation that "using Audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception." In September, the company said in-market versions of Windows client and Windows Server will continue to support NTLM, but also declared that "our long-term objective is a Windows platform that doesn't need NTLM at all."
The difficulty stems from NTLM's three-decade lifespan: it first appeared in 1993 with Windows NT 3.1, and getting rid of it in corporate settings has proved challenging even though it's somewhat insecure by today's standards. Microsoft removed the protocol from Windows 11 24H2 and Windows Server 2025, but pieces remain in specific connection types, which is why the company introduced audit mode in 2025 to help administrators identify where the technology was still active. Now, in 2026, if Credential Guard isn't enabled and BlockNtlmSSO isn't set to Audit mode, the use of NTLMv1-derived credentials will be refused as Microsoft works to finalize the protocol's disablement. The report notes there's no indication of how long the BlockNtlmSSO workaround will remain functional—most likely until the next major Windows release.
The switch to enforce blocking by default sends an unmistakable signal: the technology still exists in the operating system but is on its way out and will be removed in a future Windows release. Network failures following the October 2026 Windows security update could therefore reveal that migration plans aren't as advanced, or as finished, as administrators might have believed. Organizations that suddenly face authentication problems now have a narrow window to either complete their transition to modern protocols or accept the temporary security trade-off of reverting to Audit mode—knowing that option won't last forever. The decision to make enforcement the default rather than opt-in transforms what was once a background deprecation into an operational pressure point that can no longer be deferred or ignored.