Windows KB5127648: 802.1X Wi-Fi, wired and VPN sign-in fails (NTLMv1 SSO blocked)

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0  BlockNtlmv1SSO  (not set = Enforce after KB5127648)

Short answer: The October 2026 Windows update (KB5127648 on Windows 11, KB5126646 on Windows Server 2025) makes Windows treat a missing BlockNtlmv1SSO value as Enforce instead of Audit, which blocks NTLMv1-derived single sign-on credentials. PEAP-MSCHAPv2 Wi-Fi, wired 802.1X and VPN profiles that sign in with the Windows logon then fail, while typing the password by hand still works. Set BlockNtlmv1SSO to 0 by Group Policy or Intune to get people back online, then move those networks to certificate-based sign-in (EAP-TLS or PEAP-TLS) or turn on Credential Guard.

Why it happens

Microsoft is hardening NTLMv1. Message center post MC1508562 warns that the change can affect network connections on devices without Credential Guard. From the October 2026 update, if BlockNtlmv1SSO is absent, Windows uses Enforce mode (1) instead of Audit mode (0). Devices with Credential Guard running, certificate-based methods (EAP-TLS, PEAP-TLS), PSK networks and manually entered credentials are not affected, which is why only some PCs and networks break.

You may also see

Event ID 4025, Microsoft-Windows-NTLM/Operational (blocked NTLMv1 single sign-on)

Windows Server 2025: KB5126646

Fix

1. Confirm the cause on one PC: the network connects when the user types the password, and Event Viewer shows event 4025 under Applications and Services Logs → Microsoft → Windows → NTLM → Operational.
2. Find every affected PC and network with the free, read-only script Test-NtlmV1WifiImpact. It checks the update, BlockNtlmv1SSO, Credential Guard, each Wi-Fi and wired profile's EAP method and whether it uses the Windows logon, plus event 4025, and writes one CSV row per profile (.\Test-NtlmV1WifiImpact.ps1 -Csv \\server\share\%COMPUTERNAME%.csv from a startup script or Intune).
3. Stop-gap: create the DWORD BlockNtlmv1SSO = 0 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. Use Group Policy Preferences (Computer Configuration → Preferences → Windows Settings → Registry) or an Intune script for many PCs. Reconnect, or restart if it does not take effect.
4. Lasting fix: move each affected network to certificate-based sign-in. Issue device or user certificates (Active Directory Certificate Services auto-enrolment, or Intune SCEP/PKCS). In the NPS network policy, add the certificate method (EAP-TLS, or PEAP with certificates). Push the new Wi-Fi, wired or VPN profile to a pilot group, test it, then roll it out and remove PEAP-MSCHAPv2.
5. Or turn on Credential Guard on hardware that supports it: devices with Credential Guard running are not affected.
6. When every network is on certificates (or Credential Guard), remove the stop-gap value or set it to 1 so the weaker NTLMv1 sign-in stays off.

Watch out

• Uninstalling KB5127648 only helps until the next cumulative update, which carries the same change.
• BlockNtlmv1SSO = 0 turns the weaker NTLMv1-derived sign-in back on: treat it as a bridge, with a date to remove it.
• Users who type their password still connect, so a quick note to staff keeps people working while you deploy the fix.

Sources

• Microsoft 365 message center MC1508562: NTLMv1 hardening changes might affect network connections
• Microsoft Q&A: KB5127648 breaks WPA2-Enterprise 802.1X PEAP Wi-Fi (400+ same question)
• Zyxel Community: WPA-Enterprise 802.1X (PEAP) clients fail to connect after Windows update

Other errors breaking soon

• Firebase: Runtime Node.js 20 was decommissioned
• Google Cloud Python: non-supported Python version (3.10)
• OpenAI: "The model … has been deprecated" or "Model not found" after a shutdown
• pytest 9.2: xdist_group tests run on different workers (--dist loadgroup)
• WordPress 7.2 ignores data-wp-init--, data-wp-watch-- and data-wp-run-- directives
• Ubuntu 26.04 upgrade stops with "Unable to upgrade MySQL" (mysql_native_password accounts)

All "breaking soon" fixes