Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025

Applies To
Windows 11 version 26H2, all editions Windows 11 version 25H2, all editions Windows 11 version 24H2, all editions Windows Server 2025

Note

  • Original publish date: August 29, 2025
  • KB ID: 5066470

Introduction

This article details changes in Windows 11, versions 26H2, 25H2, and 24H2 and Windows Server 2025, focusing on the auditing and enforcement of blocking NTLMv1-derived cryptography. These changes are part of the broader Microsoft initiative to phase out NTLM.

The October 2026 Windows security update introduces a change that strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. With this change, Windows uses Enforce mode (1) instead of Audit mode (0). This change applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication.

Background

Microsoft has removed the NTLMv1 protocol (see Removed features and functionality) from Windows 11, version 24H2 and Windows Server 2025 and later versions. However, while the NTLMv1 protocol is removed, remnants of NTLMv1 cryptography are still present in some scenarios, such as when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2, in a domain-joined environment.

Beginning with Windows updates released in August 2025, Audit mode was introduced to help administrators identify dependencies on NTLMv1-derived credentials before enforcement.

Credential Guard provides complete protection of both NTLMv1 legacy cryptography and many other attack surfaces, and thus Microsoft strongly recommends its deployment and enablement if Credential Guard’s requirements are met. The changes outlined in this article only affect devices where Credential Guard is disabled; if Windows Credential Guard is enabled on the device, these changes do not take effect.

Goal

With the deprecation of NTLM (see Deprecated features) and the removal of the NTLMv1 protocol, Microsoft is working to finalize the disablement of NTLMv1 by blocking the use of NTLMv1-derived credentials.

Changes

Behavior before installing October 2026 Windows security update: Before installing the October 2026 Windows security update, released on October 13, 2026, when the BlockNtlmv1SSO registry value is not set, Windows uses Audit mode (0). Requests to use NTLMv1-derived credentials for Single Sign-On are audited but allowed, and warning events are generated.

Behavior after installing the October 2026 Windows security update: After installing the October 2026 Windows security update, released on October 13, 2026, when the BlockNtlmv1SSO registry value is not set; Windows uses Enforce mode (1) instead of Audit mode (0). The update does not create or modify the registry value. In Enforce mode, requests to use NTLMv1-derived credentials for Single Sign-On are blocked.

For a timeline of these changes, see the Rollout of changes section.

New registry key

Windows updates released in August 2025 introduced a new registry key, BlockNtlmv1SSO, that controls whether the changes operate in Audit mode or Enforce mode.

Note: Administrators can configure BlockNtlmv1SSO either before or after installing the October 2026 Windows security update.

Registry location HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\msv1_0
Value BlockNtlmv1SSO
Type REG_DWORD
Data
  • 0 - The request to generate NTLMv1-credentials for a logged-on user is audited but allowed to succeed. Warning events are generated. This setting is also called Audit mode.
  • 1 - The request to generate NTLMv1-credentials for a logged-on user is blocked. Error events are generated. This setting is also called Enforce mode.
Restart A device restart isn’t required after you change the BlockNtlmv1SSO.

Beginning with the October 2026 Windows security update released on October 13, 2026, Enforce mode (1) becomes the internal default behavior on eligible devices when the BlockNTLMv1SSO registry value is not set.

Note that the default behavior change does not create or modify the registry value, which itself remains absent.

New auditing capabilities

  • When using Audit mode

    Event Log Microsoft-Windows-NTLM/Operational
    Event Type Warning
    Event Source NTLM
    Event ID 4024
    Event Text Auditing an attempt to use NTLMv1-derived credentials for Single Sign-On
    Target server: <domain_name>
    Supplied user: <user_name>
    Supplied domain: <domain_name>
    PID of client process: <process_identifier>
    Name of client process: <process_name>
    LUID of client process: <locally_unique_identifier>
    User identity of client process: <user_name>
    Domain name of user identity of client process: <domain_name>
    Mechanism OID: <object_identifier>
    For more information, see https:⁠//go.microsoft.com/fwlink/?linkid=2321802.

  • When using Enforce mode

    Event Log Microsoft-Windows-NTLM/Operational
    Event Type Error
    Event Source NTLM
    Event ID 4025
    Event Text An attempt to use NTLMv1-derived credentials for Single Sign-On was blocked due to policy.
    Target server: <domain_name>
    Supplied user: <user_name>
    Supplied domain: <domain_name>
    PID of client process: <process_identifier>
    Name of client process: <process_name>
    LUID of client process: <locally_unique_identifier>
    User identity of client process: <user_name>
    Domain name of user identity of client process: <domain_name>
    Mechanism OID: <object_identifier>
    For more information, see https:⁠//go.microsoft.com/fwlink/?linkid=2321802.

For more information about other auditing enhancements, see Overview of NTLM auditing enhancements in Windows 11, version 24H2 and Windows Server 2025.

Rollout of changes

In September 2025 and later updates, the changes were rolled out to Windows 11, version 24H2 and later versions in Audit mode. In this mode, Event ID: 4024 was logged whenever NTLMv1-derived credentials were used, but the authentication continued to work. The rollout reached Windows Server 2025 later in 2025.

Beginning with the October 2026 Windows security update, released on October 13, 2026, Microsoft strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows uses Enforce mode (1) instead of Audit mode (0).

In Enforce mode, requests to generate NTLMv1-derived credentials for Single Sign-On are blocked instead of only being audited.

This change might affect environments that still rely on NTLMv1-derived credentials for Single Sign-On, including certain Wi-Fi, Ethernet, and VPN authentication configurations that use MS-CHAPv2.

Timeline

Date Change
Late August 2025 Auditing logs for NTLMv1 usage enabled on Windows 11, version 24H2 and newer clients.
November 2025 Begin rollout of changes to Windows Server 2025.
October 2026 The October 2026 Windows security update changes the default behavior when the BlockNtlmv1SSO registry value is not set. If the value is absent, Windows uses Enforce mode (1), instead of Audit mode (0), without creating or modifying the registry value, which remains absent. In Enforce mode, the use of NTLMv1-derived credentials for Single Sign-On is blocked.

Preparing for Enforce mode

Use the audit mode events described in this article to identify authentication flows that depend on NTLMv1-derived credentials before deploying the change broadly. Environments using MS-CHAPv2 Single Sign-On for Wi-Fi, Ethernet, or VPN authentication should be evaluated for potential dependencies.

Temporary security exception

If an organization identifies a critical authentication dependency that cannot immediately be migrated, setting BlockNTLMv1SSO to 0 (Audit) temporarily allows NTLMv1-derived Single Sign-On credentials while remediation is completed.

Important: Using Audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception.

Frequently asked questions (FAQ)

Q1: Why is there a difference between when client and servers get the changes?

Microsoft uses a gradual rollout method to distribute a release update over a period of time, rather than all at once. This means that users receive the updates at different times, and it might not be immediately available to all users.

Q2: Where are NTLMv1-derived credentials used?

NTLMv1-derived credentials are used by certain higher-level protocols for Single Sign-On purposes; examples include Wi-Fi, Ethernet, and VPN deployments using MS-CHAPv2 based authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. In Enforce mode, Single Sign-On flows that depend on NTLMv1-derived credentials are blocked. Manually entering credentials will continue to work in Enforce mode. For more information and best practices, see Considerations and known issues when using Credential Guard.⁠⁠

Q3: Are there other similarities between this update and Credential Guard?

The only similarity between this update and Credential Guard is protections around user credentials from NTLMv1-derived cryptography. This update does not provide the wide and robust protection of Credential Guard; Microsoft recommends Credential Guard enablement on all supported platforms.

This article will be updated if additional guidance becomes available.

References

Change log
Date Change
October 14, 2026 Edits across the article were made to reflect the latest enforcement changes concluded on October 2026 and highlight impact on Wi-Fi, Ethernet, and VPN deployments using MS-CHAPv2 based authentication.