KB5127648 Ends Windows 11 24H2 Home and Pro Updates, Enforces NTLMv1 SSO Block

By pairing the hosts' commentary with Microsoft's official support advisories, Windows release health bulletins, and hardware documentation, we can separate industry critique from hard administrative action items. Whether you manage an enterprise fleet navigating legacy authentication protocols or maintain a household Microsoft 365 subscription, the mid-October changes carry real technical consequences.

October Patch Tuesday (KB5127648): 24H2 End of Servicing and Build Breakdown​

On the Windows Weekly rundown, the hosts highlighted October Patch Tuesday as a milestone release, pointing to a reported tally of more than 1,400 security fixes across the broader cycle alongside major lifecycle transitions: it marks the first Patch Tuesday for Windows 11 version 26H2 and the final monthly servicing release for consumer editions of version 24H2.

In Microsoft Support's official documentation, the October 13, 2026 cumulative security update is cataloged as KB5127648, bundled with servicing stack update KB5127647 (Build 26100.9703). It advances the three mainstream Windows 11 branches to the following operating system builds:

For consumers and small businesses running Windows 11 version 24H2 Home or Pro, KB5127648 is the end of the line. Microsoft Support and the Windows Message Center state that after October 13, 2026, these editions will no longer receive monthly security updates or non-security preview updates. To stay protected, those machines must move to Windows 11 version 25H2 or 26H2.

Enterprise and Education administrators get a longer runway: Windows 11 version 24H2 Enterprise and Education remain in support until October 12, 2027, though Microsoft notes that September's KB5124010 was the final non-security preview update for 24H2. Meanwhile, on the legacy enterprise front, Microsoft's Windows Message Center confirms that Windows 10 Enterprise LTSB 2016 also reached end of updates on October 13, 2026, with Microsoft steering organizations toward Windows 11 Enterprise LTSC 2024 or Extended Security Updates (ESU). The podcast rundown also noted big changes for version 26H1 alongside the minor servicing updates for 24H2, 25H2, and 26H2.

Section Summary: KB5127648 brings Windows 11 versions 26H2, 25H2, and 24H2 to builds .9711 while terminating monthly servicing for 24H2 Home and Pro as well as Windows 10 Enterprise LTSB 2016.

Under the Hood of KB5127648: NTLMv1 Hardening, ReFS Auditing, and Known Issues​

While the podcast notes characterizes the user-facing functional changes in KB5127648 for 24H2, 25H2, and 26H2 as minor, the under-the-hood security hardening and bug fixes in Microsoft's release notes demand close attention from system administrators.

1. NTLMv1 Single Sign-On Blocked by Default​

As part of Microsoft's ongoing campaign to phase out NTLM, the October 2026 security update alters the internal default behavior for the BlockNtlmv1SSO registry value across Windows 11 (versions 26H2, 25H2, and 24H2) and Windows Server 2025.

• What changed: When the BlockNtlmv1SSO registry value is not explicitly configured, Windows now defaults to Enforce mode (1) rather than Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO).
• Scope: This change specifically targets devices where Windows Credential Guard is disabled and the registry value is unset.
• Practical impact: Environments still relying on MS-CHAPv2 authentication for Wi-Fi, wired Ethernet (802.1X), or VPN connections may experience SSO connection failures. Microsoft advises IT teams in the Windows Message Center to migrate affected Wi-Fi and VPN profiles to certificate-based authentication, noting that administrators can temporarily set the registry to audit/allow while removing legacy dependencies.

2. ReFS External Volume Auditing and Secure Boot Certificates​

Microsoft is also staging protections for Resilient File System (ReFS) volumes on externally attached storage devices (documented further under KB5130741). KB5127648 enables auditing by default while leaving enforcement controls disabled by default so administrators can evaluate logs ahead of future hardening. Additionally, Windows Update continues its automated rollout of updated Secure Boot certificates to replace certificates that began expiring in 2026. If you maintain offline installation media and apply Dynamic Updates, Microsoft warns that you must manually copy the matching boot.stl file from Windows\Boot\EFI into the corresponding folder on your installation media to avoid boot validation failure 0xc0430001.

3. Notable Fixes in KB5127648​

• Azure Virtual Desktop and FSLogix: Resolves a black-screen bug where Explorer.exe failed to start or repeatedly crashed upon sign-in in multi-user environments.
• Always On VPN: Fixes a regression introduced after KB5124008 where connections using automatic protocol selection or fallback got stuck in a "Connecting" state or returned "The specified port is already in use."
• Storage Spaces Direct: Fixes an issue preventing tiered Storage Spaces Direct virtual disks from coming online after certain security updates.
• Hardware, Peripherals, and Gaming: Resolves mouse input stutter in certain games, fixes cold-boot Windows Hello fingerprint sign-in failures on some PCs, restores AC-3 audio playback in affected apps, and fixes printing failures with RAW or Generic Text Only drivers dating back to August 2026.
• Time Zones and AI Components: Adds the (UTC-05:00) Manitoba time zone ahead of Manitoba's November 1, 2026 change, and updates four Copilot+ PC AI components (Image Search, Content Extraction, Semantic Analysis, and Settings Model) to version 1.2608.951.0.

4. Known Issue: Remote Desktop Error 0xC000000D​

Enterprise admins deploying KB5127648 (or September's preview update KB5124010) should watch out for a confirmed Remote Desktop regression:

• Symptom: Non-admin users attempting to establish Remote Desktop connections to remote host machines with Administrator protection enabled may be blocked with error 0xC000000D and the message: "The token that was passed to the function is invalid."
• Why it surprises admins: Microsoft notes that if your organization applies Windows security baselines from the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in the baselines for Windows 11 versions 24H2, 25H2, and 26H2.
• Workaround: Until Microsoft ships a permanent fix, administrators can mitigate the issue on affected Remote Desktop hosts via Microsoft Intune or Group Policy by resetting the User Account Control: Type of Admin Approval Mode policy to temporarily disable Administrator protection.

(Note: Microsoft also continues to track a partial known issue from September's KB5124012 affecting USB Audio Class 1.0 devices showing Code 10 in Device Manager; while out-of-band update KB5129195 fixed 8-channel and 3D audio symptoms, other stereo/startup symptoms remain under investigation.)

Section Summary: Beyond routine patching, KB5127648 flips unset NTLMv1 SSO behavior to Enforce mode on systems without Credential Guard, fixes major Always On VPN and AVD Explorer bugs, and carries a known Remote Desktop token failure (0xC000000D) when Administrator protection is active.

The "RTX Spark" Era and Microsoft's October 7 Hardware Showcase​

A centerpiece of the Windows Weekly discussion was Microsoft's October 7 Windows and Surface event and the retail arrival of the RTX Spark platform—including hardware such as the RTX Spark-based ASUS ProArt P16. On the podcast, Thurrott and his co-hosts offered a pointed critique of the October 7 presentation, characterizing its local AI narrative as confusing and arguing that Microsoft failed to demonstrate major new end-user software features exclusive to RTX Spark that would distinguish the experience from existing Copilot+ PCs. They also noted a strange "Osborne Effect" around RTX Spark announcements and cited industry pain as the broader PC market fell more than 20 percent in the third quarter amid a component crisis.

To understand what RTX Spark actually brings to the table technologically, it helps to compare the podcast's software critique against the architectural specifications Pavan Davuluri, Executive Vice President of Windows + Devices, detailed on the Windows Experience Blog when introducing the platform alongside Surface Laptop Ultra:

• Silicon Architecture: Developed in collaboration between Microsoft and NVIDIA, RTX Spark combines up to 20 Arm-architecture cores, up to 6,144 NVIDIA Blackwell RTX GPU cores, and up to 128 GB of unified memory, rated by the vendors at up to 1 petaflop of AI performance.
• Relationship to Copilot+ PCs: Rather than replacing the Copilot+ PC designation, Microsoft states that RTX Spark systems join the Copilot+ PC category, pairing NPUs for local AI tasks with high-wattage Blackwell GPU acceleration and the Microsoft Power and Thermal Framework (MPTF).
• OS and Memory Optimizations: To make up to 128 GB of unified memory usable for local AI models and 3D rendering, Microsoft raised the limit on total system memory accessible by the GPU and optimized shared-memory page sizes in Windows 11. These devices also rely on Microsoft's Prism emulator (with AVX/AVX2 support tuned for RTX Spark's microarchitecture) for x86/x64 apps alongside native Arm64 creative and gaming titles, and introduce NVIDIA OpenShell built on Windows security and containment primitives for running local AI agents such as Hermes Agent and OpenClaw.

In short, the divide highlighted on Windows Weekly comes down to hardware capability versus everyday consumer software. For AI developers running local models via Windows ML, TensorRT, or WSL, and for creative pros using native Arm versions of DaVinci Resolve, Blender, or Adobe Photoshop, 128 GB of unified memory and a Blackwell GPU represent a clear workstation leap. For a general Windows 11 buyer asking what exclusive Windows OS feature requires an RTX Spark laptop today, the hosts' skepticism reflects a real messaging gap.

Section Summary: RTX Spark merges Arm CPU cores, NVIDIA Blackwell RTX graphics, and up to 128 GB of unified memory under the Copilot+ PC umbrella, though Windows Weekly argues Microsoft's October 7 event lacked compelling end-user software exclusives for the platform.

Microsoft 365 Consumer Storage Overhaul: 2 TB Pooled Quotas​

The podcast also flagged a major shift for consumer subscribers to Microsoft 365 Family and Microsoft 365 Premium. Previously, shared consumer plans were structured around individual 1 TB OneDrive allocations per person (up to 6 TB across six users).

According to Microsoft Support's official documentation on Microsoft 365 storage changes, the company has transitioned to a pooled cloud storage model:

• The New Quotas: Microsoft 365 Family and Microsoft 365 Premium now include 2 TB of shared cloud storage in a single pool for the primary subscriber and up to five additional people (six members total). A higher tier, Microsoft 365 Pro, includes 5 TB of shared storage across up to six members. (Single-user Personal and Basic plans remain at 1 TB and 100 GB, respectively.)
• Effective Dates: The 2 TB pooled model took effect on October 8, 2026 for all new subscriptions and plan upgrades. If you held an existing Microsoft 365 Family or Premium subscription prior to October 8, 2026, your plan keeps its current structure until its first renewal on or after May 2, 2027—unless you proactively upgrade your plan (for example, moving from Family to Premium) before that date, which triggers the 2 TB shared pool immediately.
• Privacy and Overages: Sharing a storage pool does not share your files; each member's OneDrive documents and photos remain private unless explicitly shared. Paid storage add-ons (scalable up to 10 TB) and eligible free storage grants feed into the shared pool, and Microsoft notes that eligible existing subscribers in supported markets may receive transitional bonus storage at renewal. If a family exceeds its quota, files remain accessible for up to one year while members manage their usage.

Microsoft frames pooled storage as a flexibility upgrade—allowing one heavy user in a household to use more than 1 TB without hitting a personal ceiling while other family members use very little. However, for power-user households where three or more family members each store close to 1 TB of video backups or raw photos, dropping from six separate 1 TB buckets to a single 2 TB pool is a net reduction that will require either pruning data or buying storage add-ons after May 2027. Meanwhile, the Windows Weekly rundown noted that all members on shared plans now share the same Copilot rights; because Microsoft's storage FAQ focuses strictly on OneDrive quotas rather than specific AI usage tiers, subscribers should check their Microsoft account portal for exact Copilot entitlement terms.

Section Summary: Starting October 8, 2026 for new or upgrading customers—and on renewals from May 2, 2027 for existing subscribers—Microsoft 365 Family and Premium move to a single 2 TB shared storage pool across up to six users.

AI, Development, and Xbox Rundown Notes​

Rounding out episode 1005, Laporte, Thurrott, and Campbell surveyed a busy week across software development, open-source tools, and gaming:

• AI, Open Source, and Dev Tools: Thurrott spotlighted ArtCraft as his app pick of the week, noting that its free, open-source, Rust-based desktop suite has released clones of seven top Adobe Creative Cloud applications alongside early clones of Microsoft Word, Excel, PowerPoint, AutoCAD, and an audio editor. The hosts also discussed Google Playground and Google AI Studio's "vibe-coding" workflows for Android and web apps, Apple's smart home push centered on Siri AI and a HomeView smart display, the Tiny11 Builder utility receiving a WinUI interface makeover, and .NET 11 nearing completion.
• Xbox and PC Gaming: On the gaming front, the show rundown covered Xbox forming an "XP" division for non-game entertainment, Asha Sharma establishing an XBOX LABS team to explore how vibe coding affects game development, and Microsoft announcing an Xbox Nano Controller. In cross-platform and PC release chatter, the hosts discussed Forza Horizon 6 heading to PlayStation 5 in January, Grand Theft Auto VI targeting a PC release in early 2027, and Epic Games launching a preview of a vibe-coded launcher across Windows, macOS, and Linux.
• Community Picks: Alongside ArtCraft, the episode noted RunAs Radio episode 1058 ("Choosing Tools in M365" with Joy Apple) and Bunnahabhain 12 as the week's brown liquor pick.

How is your environment handling the October 2026 Windows 11 update and the end of consumer support for 24H2? Join the discussion in our Windows 11 Updates and Enterprise IT Administration sections here on WindowsForum.com to share your deployment notes.