Over the last few days I’ve seen a lot of reports that the latest Windows security update is “breaking” WPA2-Enterprise Wi-Fi, 802.1X authentication, VPNs and other RADIUS-based connections.
Let’s be clear:
This is not a bug. This is a planned security hardening change that Microsoft announced well in advance (August 2025). [support.mi…rosoft.com], [mc.merill.net]
The October 2026 security update changes the default behavior for NTLMv1-derived Single Sign-On (SSO) credentials from Audit to Enforce mode on systems where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not configured.
Why are Wi-Fi and RADIUS environments affected?
Many legacy enterprise Wi-Fi, wired 802.1X and VPN deployments still rely on:
- PEAP-MSCHAPv2
- EAP-MSCHAPv2
- Other MS-CHAPv2-based authentication methods
These technologies depend on NTLMv1-derived cryptography for SSO scenarios. Microsoft has been warning that NTLM is being phased out and that organizations should move away from these legacy methods. [support.mi…rosoft.com], [learn.microsoft.com]
About the registry “fix”
A lot of articles are recommending:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
BlockNtlmv1SSO = 0
Yes, this can restore connectivity by putting the device back into Audit mode. However:
This is not the fix.
It is only a temporary workaround that re-enables behavior Microsoft is actively retiring. Microsoft explicitly states that Audit mode should only be treated as a temporary exception while organizations remediate their environment.
Here are Intune Custom Remediation Scripts to deploy the key:
The real long-term solution
Instead of permanently forcing:
BlockNtlmv1SSO = 0
organizations should:
- Review their wireless and VPN authentication design
- Identify dependencies on PEAP-MSCHAPv2 and EAP-MSCHAPv2
- Move to certificate-based authentication where possible
- Enable Credential Guard where supported
- Eliminate reliance on NTLMv1-derived authentication paths
Microsoft specifically recommends moving Wi-Fi and VPN deployments from MS-CHAPv2-based authentication to certificate-based solutions such as EAP-TLS or PEAP-TLS. [learn.microsoft.com], [support.mi…rosoft.com]
My recommendation
If your users suddenly lost connectivity after installing the October update:
- Use
BlockNtlmv1SSO=0only as an emergency workaround. - Enable Credential Guard where supported.
- Audit your wireless, wired 802.1X, VPN and RADIUS infrastructure.
- Plan your migration away from MS-CHAPv2 and NTLMv1-derived authentication.
The update is doing exactly what Microsoft said it would do. The registry change merely buys time. The real work is modernizing the authentication architecture before NTLM finally disappears from Windows.
#Windows11 #Security #NTLM #CredentialGuard #WiFi #RADIUS #8021X #NPS #MicrosoftSecurity #IdentitySecurity #EAPTLS #CyberSecurity #PatchTuesday
