Windows October 2026 Update: NTLMv1 SSO Breaks Wi-Fi and VPN, Plus Key IT Deadlines

Below is the full list, sorted by urgency, with build numbers and the NTLMv1 details you need before your next change window.

The update numbers you'll need​

Microsoft's Windows 11 release information page lists the October 13, 2026 security update (the "B" release) as KB5127648. It applies to:

The roundup doesn't give a KB number for the optional non-security preview. According to the release information page, the late-October "D" release for 26H2 and 25H2 is KB5127936, so that's the package to install if you want an early look at the November features below. The same page lists Windows 11 23H2 Enterprise and Education end of updates as 2026-11-10, which matches the lifecycle reminder in the roundup.

Summary: KB5127648 is October's security baseline. KB5127936 is the optional preview for 26H2 and 25H2 only.

Start here: NTLMv1 SSO hardening is now enforced​

The roundup says the October 2026 security update restricts NTLMv1-derived credentials for single sign-on on supported Windows 11 and Windows Server 2025 devices when Credential Guard is disabled. It tells organizations that use MS-CHAPv2 for Wi-Fi, Ethernet or VPN to find those configurations and move to certificate-based authentication.

The mechanism matters. Beginning with the October 2026 security update, Windows uses Enforce mode as the internal default behavior instead of Audit mode, if the registry key BlockNtlmv1SSO has not been previously configured. Independent coverage notes that the October 13 update does not write the value, so checking the registry won't show you the new behavior. A device with no value set is now in Enforce mode.

What fails is specific. According to Microsoft's message center notice MC1508562, Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, including PEAP-MSCHAPv2 and EAP-MSCHAPv2, for Single Sign-On might consequently fail to connect automatically. Credentials a user types in by hand still work. Only the automatic reuse of the logged-on user's credentials is blocked. Microsoft also says that it is not a known issue with the October 2026 security update. It's a planned change that was announced in advance. Windows has logged the dependency in audit mode since August 2025.

Many administrators didn't notice the advance notice. On a Microsoft Q&A thread that began on Patch Tuesday, admins reported PEAP-based 802.1X failures across several hardware vendors and chipsets, and said uninstalling KB5127648 restored connectivity. One admin's NPS logs showed requests discarded as malformed. Another admin wrote that they had assumed breaking changes would arrive with a feature update, not a routine monthly patch. These are user reports, not Microsoft findings, and not every symptom in that thread should be read as a universal defect.

How to triage and fix it​

1. Check Credential Guard first. Teams investigating failures should first check whether Credential Guard is enabled, review Windows authentication and NTLM audit events, and inspect 802.1X and VPN profiles for MS-CHAPv2 SSO dependencies. The registry value doesn't help Credential Guard devices, because Credential Guard blocks MS-CHAPv2 single sign-on regardless of BlockNtlmv1SSO.
2. Read the events. The value's data is 0 = Audit (allowed, Event ID 4024), 1 = Enforce (blocked, Event ID 4025). 4025 events mean the block is working against something you still use.
3. Use the temporary rollback only if you have to. Setting the BlockNtlmv1SSO DWORD under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 to 0 restores audit mode, and 1 enforces it. Microsoft's documentation, as summarized by independent analysis, says 0 is Audit mode and 1 is Enforce mode, and that no restart is needed after changing it. If you deploy the value by Group Policy, you avoid uninstalling a security update.
4. Fix the cause. Migrate 802.1X and VPN profiles to certificate-based EAP. Microsoft's guidance is to return to the Enforce mode by setting BlockNtlmv1SSO to 1 once the dependencies are removed. One Q&A poster said that moving off MS-CHAPv2 also let them finally turn on virtualization-based security and Credential Guard.

Windows Server 2025 gets the same treatment: KB5127648 for Windows 11 and KB5126646 for Windows Server 2025 are the October updates that changed the default.

Summary: The registry value set to 0 gives you time, not a fix. MS-CHAPv2 SSO is on its way out, and certificate-based authentication is what Microsoft wants you using.

Security changes​

• eMudhra certificate distrust. Microsoft says it blocked certificate authorities affected by compromised eMudhra intermediate CA keys and removed seven associated certificates from the Windows and Microsoft Edge trust lists. Keep automatic Windows certificate trust updates and Edge component updates enabled. Check disconnected or air-gapped devices, which won't get trust-list changes on their own, and replace any certificates that chain to the removed ones. The roundup doesn't name the seven certificates, so get the exact identities from Microsoft's advisory before you start replacing anything.
• Microsoft Entra registration during sign-in. Users can now complete Entra registration as part of sign-in instead of going through a separate workflow. Microsoft ties this to its token protection deployment guidance for Windows. No rollout timeline or configuration steps were given.
• Microsoft Execution Containers (MXC), now generally available. MXC lets developers and administrators contain AI agents with policy and limit their access to files and network destinations. Microsoft Learn describes MXC as an open-source, policy-driven technology with .NET, TypeScript and Rust SDKs. Workloads can run in an OS process sandbox, a separate session or a virtualized environment. Microsoft's own documentation adds two cautions: available controls "depend on the MXC release, backend, and host," and containment doesn't make an agent's outputs trustworthy. MXC limits what an agent can do. It doesn't check whether what it did was correct.
• WSL containers, now generally available. You can run Linux container workloads directly on Windows, with enterprise controls through Intune and security visibility through Defender for Endpoint.

Update and device management​

The roundup also lists several management changes:

• Windows Update certificate rotation. The certificates Windows uses to establish trusted connections to Windows Update expire in May and June 2027. Replacement certificates will reach most devices through monthly updates, but Microsoft warns that some devices may need IT action. Devices that miss updates for long stretches are the ones to watch.
• Restore and recovery. On Windows 11 24H2 and later, users can review a restore summary during setup or first sign-in. Cloud rebuild, which restores a PC to a clean state with a full OS reinstall, is now broadly available. Devices in the Windows Recovery Environment can reuse saved Wi-Fi profiles to get back online.
• Windows 365 and Windows App. Remote PC connections in Windows App on Windows are generally available.
• Intune Endpoint Privilege Management. Standard users can change IT-approved IPv4, IPv6 and DNS settings through Company Portal. Admins can allow changes automatically or require confirmation, a business justification or Windows authentication.
• Intune CNAME auto-discovery retirement. Starting January 15, 2027, Intune ends support for CNAME-based auto-discovery in Windows MDM-only enrollment.
• Sysinternals. Updates cover Process Explorer, Process Monitor, ProcDump, ZoomIt and other tools.
• Time zones. Parts of Canada (British Columbia, Alberta, Manitoba, the Northwest Territories and northwestern Ontario) didn't turn clocks back on November 1, 2026. Cuba announced a daylight saving change on October 27, 2026. Microsoft has published guidance for both.

Windows Server 2025 changes​

• Quick machine recovery is now supported on Windows Server 2025 but is off by default. You turn it on through Group Policy to speed up recovery during widespread outages.
• ReFS on external storage. The October update adds auditing and optional policy controls for ReFS volumes on externally attached storage. Auditing is on by default. Enforcement stays off by default until January 2027, so use the audit data now to see what would break.
• ML-KEM in TLS 1.3. Server 2025 now supports ML-KEM post-quantum key exchange in TLS 1.3. This is aimed at "harvest now, decrypt later" attacks against encrypted connections.
• RD Web Access and XSLT. RD Web Access relies on XSLT to render in Edge and Chrome, and both browsers are removing XSLT support. Review Microsoft's workarounds before users find a blank page.

Microsoft doesn't give policy names or paths for these items, so check the Windows Server 2025 release notes before you change anything.

Windows 11 features in the October security update​

These features are rolling out gradually on 26H2, 25H2 and 24H2, so installing KB5127648 doesn't mean every PC gets them right away:

• File Explorer: Home remembers which sections you expanded or collapsed, and the preview pane now previews PDFs downloaded from the web.
• Bluetooth: More accurate connection and volume status, better microphone compatibility, and more stable LE Audio and shared audio.
• Open apps maximized: A new accessibility setting that maximizes app windows when they open. It helps screen reader and magnifier users, tablet users, and anyone who prefers full-screen windows.
• Touchpads: Single-finger scrolling and automatic scrolling.
• Copilot key remapping: The key can now act as Right Ctrl or the Context Menu key. That's welcome for anyone who lost a shortcut when the key replaced Right Ctrl on their keyboard.

Previewing November: the optional update​

The November 2026 security update will bring these features, and you can try them now on 26H2 and 25H2 by installing the October optional preview:

• Edge Accelerated App Launch: Edge opens faster and more consistently, especially when the PC is busy.
• Policy-based in-box app removal on Windows 11 Enterprise and Education in multi-session environments.
• File Explorer: A faster, less cluttered context menu with more control over which commands and app extensions appear. Search results now show the file name, location and date.
• Privacy & security settings: Camera, Microphone and Location controls are grouped together, with usage information alongside them.
• Magnifier and Narrator: A contrast theme toggle, separate zoom levels for each monitor, and viewport locking. Narrator can now read and navigate math equations in supported Microsoft 365 apps and in supported web content in Edge.
• Adaptive hibernate: Faster resume from Modern Standby, with hibernation timing adjusted by battery level.

My advice: try the preview on test machines, not production. The NTLMv1 episode is a good reminder of why.

Lifecycle deadlines​

The 23H2 deadline is six days away. If you still have 23H2 Enterprise or Education machines, they need a plan now.

What to do first​

The October roundup sorts into three groups:

• Do now: Find MS-CHAPv2 SSO dependencies, check eMudhra trust on disconnected machines, and move off 23H2.
• Plan: Review ReFS audit data before January enforcement, prepare RD Web Access for the XSLT removal, and get ready for the 2027 Windows Update certificate rotation and the Intune CNAME retirement.
• Nice to have: The remappable Copilot key, Explorer PDF previews and the faster context menu.

Have the NTLMv1 change or another October update broken something in your environment? Post what happened, and what fixed it, in the WindowsForum Windows 11 and Windows Server discussion threads.