Microsoft's October 2026 Windows security updates introduce new protections designed to further restrict the use of legacy NTLMv1-derived credentials. These changes may impact organizations using PEAP-MSCHAPv2 or EAP-MSCHAPv2 for enterprise Wi-Fi, wired 802.1X, or VPN authentication.
The change affects Windows 11 version 24H2 and later, as well as Windows Server 2025. On affected devices, Windows now defaults to blocking the generation of NTLMv1-derived credentials used by certain Single Sign-On authentication workflows. Users may experience corporate Wi-Fi connections that no longer connect automatically or unexpectedly prompt for credentials, even though the underlying wireless infrastructure has not changed.
A Workaround Exists, but Helient Does Not Recommend Reducing Security
Microsoft provides a BlockNtlmv1SSO setting that can temporarily restore legacy authentication behavior by configuring Windows for Audit mode instead of Enforce mode. Depending on the existing configuration, maintaining a legacy PEAP-MSCHAPv2 Single Sign-On workflow may also require Credential Guard to be disabled. Microsoft strongly recommends Credential Guard when its requirements can be met because it provides broader protection against NTLMv1 legacy cryptography and other credential attacks.
Helient does not recommend permanently reducing Windows security protections to maintain compatibility with a legacy authentication method. Where a temporary exception is necessary to restore business connectivity, it should be limited in scope and duration and accompanied by a plan to eliminate the underlying authentication dependency.
Helient Recommends Moving to Certificate-Based Authentication
The preferred long-term solution is to transition affected environments from PEAP-MSCHAPv2 to certificate-based EAP-TLS authentication. EAP-TLS authenticates trusted users or devices with certificates rather than password-derived MS-CHAPv2 credentials. This removes the affected legacy authentication dependency and allows organizations to maintain modern Windows security protections. Microsoft recommends moving affected MS-CHAPv2 environments toward certificate-based authentication methods such as EAP-TLS.
Organizations should review their Wi-Fi, NPS/RADIUS, Intune, Credential Guard, and certificate infrastructure to determine whether they are affected and develop an appropriate migration strategy. Existing enterprise PKI infrastructure or Microsoft Cloud PKI can provide the certificate services required to support EAP-TLS.
How Helient Can Help
If your organization is experiencing Wi-Fi authentication issues following the October Windows security updates, or currently relies on PEAP-MSCHAPv2, Helient can help assess the existing environment, identify any immediate remediation requirements, and develop a migration strategy to EAP-TLS. Our recommendation is simple: don't make reduced endpoint security the permanent solution to a legacy authentication dependency.
Please contact Helient to discuss your environment and the appropriate path to certificate-based authentication.
Microsoft Reference
Manage NTLMv1 changes and prevent network authentication issues in Windows