Microsoft's October 13 update blocks some NTLMv1 single sign-on
Microsoft says the October 13 update makes an unset NTLMv1 single-sign-on default mean enforce, where Credential Guard is off. Some MS-CHAPv2 sign-on can fail.
The short version
Where Credential Guard is disabled and the single-sign-on control was never set, the October 13 security update changes the built-in default from audit to enforce. In enforce mode, single sign-on that depends on NTLMv1-derived credentials is blocked. Microsoft's examples include Wi-Fi, Ethernet, and VPN using MS-CHAPv2, including PEAP and EAP variants. The update does not write the setting. Entering credentials by hand still works. This page does not describe how to reverse the default.
An unset default that changes meaning
Microsoft's servicing note on NTLMv1 in Windows 11 version 24H2 and Windows Server 2025 says the October 13, 2026 security update changes a built-in default. The case it describes is specific. Credential Guard is off. A control that decides whether NTLMv1 single sign-on is audited or enforced was never set by an administrator. Before the update, that unset state behaved as audit. After the update, the same unset state behaves as enforce. Microsoft says the update does not create the control and does not modify it. It changes what silence means. In enforce mode, single sign-on that presents credentials derived from NTLMv1 is blocked. Microsoft's own examples are Wi-Fi, Ethernet, and VPN sessions that still authenticate with MS-CHAPv2, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. The note says a person can still type credentials. The silent path is the one that breaks. The Register's October 16 story is how that note became a networking headline. The security desk isSecurity.
Who is in scope
Windows 11 version 24H2 and Windows Server 2025 are the products in the title of Microsoft's note. Inside those products, the flip applies where Credential Guard is disabled and the control was never set. A machine with Credential Guard on, or a machine where an administrator already chose a mode, is outside the sentence Microsoft uses for the automatic change. A network that never used MS-CHAPv2 is outside the examples. The Register's readers showed up because something on the network stopped signing in by itself. That symptom matches the examples. It does not, by itself, prove every outage that week was this change. Software isSoftware.
Hand entry is the path Microsoft says remains
The note distinguishes silent single sign-on from a prompt. Enforce blocks the silent NTLMv1-derived path. It does not, in Microsoft's description, remove the ability to authenticate by entering credentials. A help desk that tells every user the network is down has skipped that distinction. A help desk that wants the old silent behavior has to use Microsoft's own administrative guidance. This brief will not restate that guidance as steps. The impact and the audience are the news. The paper isFutureweb.
Why this is not a workaround page
A servicing note can contain a reversal. Printing the reversal as keys and values would turn a news brief into an operator runbook. The dependency a reader of this paper needs is smaller. After October 13, an unset control on a machine without Credential Guard means enforce. Connections that still lean on MS-CHAPv2 single sign-on can fail. Typing the secret can still succeed. The Register connects that note to reports of broken network sign-on. Yesterday's Windows Server lifecycle brief is a different document, about when a different Windows generation stops getting mainstream servicing.Windows Server 2022 mainstream end.
Audit and enforce are the two meanings of silence
Audit, in the note's terms, lets the old single sign-on proceed while recording it. Enforce refuses it. The update's content, for the unset case, is a move from the first meaning to the second. Administrators who had already written a choice are not the population Microsoft says it is flipping. The population is the people who had a default they had never looked at, and whose default changed underneath them on patch Tuesday. Hardware isHardware.
The overview page is not the change
Microsoft's older NTLM overview is a protocol description. It explains a family of authentication that Windows has carried for decades. It does not announce October 13. Citing it keeps the protocol name anchored to Microsoft without pretending the overview is the news. The news is the servicing note. The Register is the report that people noticed on their networks. Networking, as a desk, is where the symptom showed up. The dependency this brief files is the authentication default. Networking isNetworking.
What this page will not add
This page will not name a registry path, a numeric mode, or a command. It will not say every VPN in the world broke. It will not treat a forum post as Microsoft confirming a bug beyond the note. Vendor articles that attach particular update identifiers to wireless failures are those vendors' attributions. The identifier this brief is willing to state as Microsoft's is the date of the security update, October 13, 2026, and the products in the note's title. Open source isOpen Source.
A protocol retirement and a patch default
NTLMv1 has been on a long retirement. The October change is a default inside that retirement, not the invention of the protocol and not its deletion from the product. Machines that still depend on it for silent Wi-Fi or VPN sign-on discovered the retirement as an outage. That is the impact. The overview page is why the family exists in the documentation at all. Privacy isPrivacy.
Where the change sits
Microsoft's servicing note is the change. The Register is the outage narrative tied to that note. The NTLM overview is background on the protocol family. Nothing here is a reversal procedure. The short answer this page will stand on is this: Where Credential Guard is disabled and the single-sign-on control was never set, the October 13 security update changes the built-in default from audit to enforce. In enforce mode, single sign-on that depends on NTLMv1-derived credentials is blocked. Microsoft's examples include Wi-Fi, Ethernet, and VPN using MS-CHAPv2, including PEAP and EAP variants. The update does not write the setting. Entering credentials by hand still works. This page does not describe how to reverse the default.
Sources
The reports this brief is filing. Futureweb did not republish them.
Questions
Which machines does Microsoft say flip from audit to enforce?
Machines where Credential Guard is disabled and the NTLMv1 single-sign-on control was never set. The October 13, 2026 security update changes what that unset state means. Microsoft says the update itself does not create or modify the control.
Which connections does Microsoft name?
Wi-Fi, Ethernet, and VPN that use MS-CHAPv2, including PEAP-MSCHAPv2 and EAP-MSCHAPv2. The failure mode Microsoft describes is silent single sign-on that depended on NTLMv1-derived credentials. Interactive entry of credentials is still supposed to work.
Does this page include a rollback?
No. Microsoft documents that administrators have ways to keep the previous audit behavior. This brief names the impact and who is in scope. It does not print a key, a value, or a command.
What is The Register's role?
The Register's October 16 story is the news account that readers met first: networking trouble after the October update, with NTLM as the suspected cause, tied to Microsoft's servicing note. The behavior claims in this brief come from Microsoft's note.
What is the older NTLM overview for?
Microsoft's long-standing NTLM overview explains the protocol family. It is not the October 13 change. It is cited so the protocol name has a Microsoft page that is not the servicing note. The change is the servicing note.