Microsoft blocks NTLMv1 in October 2026 Windows update

Microsoft’s latest Windows security update, released in October 2026, introduces a default block on NTLMv1-derived credentials for Single Sign-On (SSO), a move that could disrupt networking for enterprises still using the deprecated protocol. The change affects authentication for Wi-Fi, Ethernet, and VPN connections in domain-joined environments, where NTLMv1 has persisted despite its long-standing security vulnerabilities and Microsoft’s years-long deprecation efforts. Administrators who have not yet migrated to modern authentication methods may face unexpected connectivity issues unless they adjust registry settings to temporarily re-enable NTLMv1 support in audit mode.

What changed in the update

The October 2026 update alters the behavior of the BlockNtlmSSO registry value, which governs whether Windows permits NTLMv1-derived credentials for SSO. Previously, Windows defaulted to Audit mode (value 0), which logged warnings but allowed requests to proceed. The update now defaults to Enforce mode (value 1), blocking such requests outright. Microsoft did not modify the registry value itself—administrators must manually set it to 0 to restore temporary compatibility. However, the company warned that using Audit mode "reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception."

Why enterprises are still affected

Despite Microsoft’s long-term goal of eliminating NTLM entirely, many organizations have struggled to fully migrate away from the protocol. NTLMv1’s integration into legacy systems, third-party applications, and network infrastructure has made its removal a complex and time-consuming process. The October 2026 update does not remove NTLMv1 from the operating system but marks a significant step toward its eventual removal. Microsoft stated in September 2026 that "in-market versions of Windows client and Windows Server will continue to support NTLM," though its long-term objective remains a Windows platform that no longer requires it.

For enterprises still reliant on NTLMv1, the update serves as a forcing function to accelerate migration plans. Administrators who encounter networking disruptions post-update may discover that their transition efforts were incomplete or overlooked certain dependencies. The temporary workaround—setting BlockNtlmSSO to Audit mode—is not a permanent solution, as Microsoft has indicated that future Windows releases will likely remove NTLMv1 support entirely.

What administrators should do

Microsoft’s enforcement of NTLMv1 deprecation by default signals the urgency of migrating to modern authentication protocols, such as Kerberos or certificate-based authentication. Administrators are advised to:

• Review audit logs to identify systems still using NTLMv1-derived credentials.
• Test the October 2026 update in a non-production environment to assess potential disruptions.
• Plan and execute a migration to modern authentication methods, prioritizing high-risk or high-impact systems.
• Use the temporary workaround (setting BlockNtlmSSO to 0) only as a short-term measure while completing the transition.

What to watch

Microsoft has not specified a timeline for the complete removal of NTLMv1 from Windows, but the October 2026 update suggests that the company is accelerating its deprecation efforts. Future major Windows releases may eliminate the protocol entirely, rendering temporary workarounds ineffective. Administrators should monitor Microsoft’s official documentation for updates on NTLM deprecation and plan accordingly to avoid last-minute disruptions.