blockntlmv1sso

The blockntlmv1sso tag covers Microsoft's phased enforcement of a registry key that blocks NTLMv1-derived credentials in Windows 11 24H2 and Windows Server 2025. The change introduces two new NTLM event IDs to distinguish audit from enforce behavior. It begins with auditing in late 2025 and moves to default enforcement for unmanaged devices by October 2026. Discussions focus on understanding the registry key, detecting NTLMv1-derived usage in enterprise environments, and preparing for the transition. This tag is relevant for IT administrators and security professionals managing Windows authentication hardening.