Microsoft’s October 2026 Windows security update can break Wi‑Fi, Ethernet, and VPN logins in environments that still rely on old NTLMv1-based sign-on. After the update, Windows switches the BlockNtlmSSO behavior from audit to enforce by default when the setting is unset, blocking NTLMv1-derived credentials instead of only logging them. Microsoft says this is intentional as it moves toward disabling NTLMv1 across Windows.
Why it matters: Organizations that still depend on legacy Windows authentication may suddenly lose network access after routine patching, so administrators need to identify NTLMv1 use and migrate quickly. The temporary workaround is to set BlockNtlmSSO to Audit mode, but Microsoft warns that reduces protection and should only be short term.
2026.10.16
100% relevant
This article establishes a new tracked story around Microsoft’s October 2026 Windows security update changing NTLMv1 enforcement behavior by default, creating immediate operational and security impact for organizations still using the deprecated protocol.
← Back to all stories