KB5127648 breaks 802.1X Wi-Fi and VPN sign-in via NTLMv1

The October 2026 cumulative update for Windows 11 (KB5127648) and Windows Server 2025 (KB5126646) switched NTLMv1 blocking to Enforce mode, so PCs stopped joining WPA2/WPA3-Enterprise Wi-Fi, wired 802.1X and VPNs using PEAP-MSCHAPv2 automatically. A temporary fix is setting BlockNtlmv1SSO=0; the permanent fix is EAP-TLS certificates or Credential Guard.

• Affected profiles use PEAP with EAP-MSCHAPv2 and Windows logon credentials
• EAP-TLS, PSK networks, Credential Guard devices and manual sign-in are unaffected
• The symptom shows up as event 4025 in the NTLM Operational log
• The BlockNtlmv1SSO=0 workaround lasts only until the next cumulative update