October 2026 Windows update blocks NTLMv1, breaking networking

The October 2026 Windows security update switches BlockNtlmSSO to Enforce mode, blocking requests that use NTLMv1-derived credentials. This can disrupt Wi-Fi, Ethernet and VPN authentication for organizations that haven't finished migrating off the legacy protocol.

• BlockNtlmSSO now defaults to Enforce mode (1) instead of Audit (0)
• NTLMv1-derived credentials are blocked for SSO, Wi-Fi, Ethernet and VPN
• Admins can temporarily restore Audit mode by setting the value to 0
• NTLM debuted in 1993; Microsoft aims to eliminate it entirely