Windows 11 Now Blocks NTLMv1 Single Sign-On by Default, and an Unset Registry Value Is the Switch

Sat, 17 Oct 2026 08:30:00 +0530

If your Windows 11 fleet signs in to Wi-Fi, wired 802.1X or VPN with an MS-CHAPv2 profile and “use my Windows credentials”, the October 13, 2026 cumulative update may have changed that behavior. KB5127648 changed the default of a registry value called BlockNtlmv1SSO from Audit to Enforce. Microsoft added the note to the KB page on October 15, two days after the release.

I have not tested this on a device. Everything below comes from Microsoft’s two pages, and I mark where I am inferring.

Windows on Kuldeep Pisda

Windows 11 Now Blocks NTLMv1 Single Sign-On by Default, and an Unset Registry Value Is the Switch