Windows 11 KB5127648 flips NTLMv1 blocking default to Enforce, breaking 802.1X login

Enterprises that installed Windows 11's October 2026 security update are losing connectivity on Wi-Fi and wired networks that rely on 802.1X authentication. The culprit is not a conventional bug: the patch, KB5127648, put a previously announced NTLMv1 blocking setting into Enforce mode, and single sign-on built on MS-CHAPv2 credentials is being rejected as a result. According to Japanese tech outlet Joho no Todai, whose report was republished in English on dev.to, the update shipped on October 13 for Windows 11 versions 24H2, 25H2 and 26H2 (builds 26100.9711, 26200.9711 and 26300.9711).

Authentication starts and then stalls

Complaints began appearing on Microsoft's Q&A forums shortly after the update arrived. The first reporter described authentication that begins and then hangs, with the connection dying on Event 12014, a OneX held-state timeout. WPA2-Personal networks are unaffected, and the failure reproduces across wireless chipsets from multiple vendors, including Intel and Qualcomm, which points to the authentication stack rather than any driver. Wired 802.1X authentication stops working as well, not just Wi-Fi.

The thread has collected more than 90 same-question confirmations, including from administrators in Chinese-speaking regions, and several admins independently verified the pattern: removing KB5127648 brings connectivity back immediately, and reinstalling it breaks the network again. As of Joho no Todai's writing, Microsoft's release notes for the update listed no known issue covering 802.1X or PEAP, and an independent community adviser noted the release health page was equally silent.

A scheduled default change caught admins off guard

The workaround that emerged points to the real cause. Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0, creating a 32-bit DWORD named BlockNtlmv1SSO and setting it to 0 restores normal operation, an answer marked helpful by more than 40 people, with some administrators pushing it out through Group Policy.

That key appears in documentation Microsoft published in August 2025, which laid out a roadmap for retiring NTLMv1-derived cryptography. Windows 11 24H2 and later removed the NTLMv1 protocol itself, but NTLMv1-derived credentials lived on in single sign-on for MS-CHAPv2 authentication over Wi-Fi, wired networks and VPNs. The September 2025 updates introduced an Audit mode that logged each use of those credentials, and Microsoft stated that the October 2026 updates would flip the default from Audit (0) to Enforce (1). KB5127648 arrived in precisely that month.

Microsoft's documentation warns that under Enforce, MS-CHAPv2 single sign-on for Wi-Fi, wired LAN and VPN connections stops working, although authentication succeeds when credentials are entered manually. Forum testing matched that description: authentication failed with the Windows user account option selected, logging WLAN-AutoConfig Event 12013 with error 0x80070285, and succeeded once users typed in a domain\username and password. The reporter also confirmed the BlockNtlmv1SSO value was unset both before and after the update, meaning machines that had never configured the setting inherited the new, stricter default.

The rollback has an expiry date

Setting BlockNtlmv1SSO back to 0 is a practical stopgap for fleets of managed devices, but it explicitly re-permits the authentication Microsoft is trying to retire. Microsoft's recommendation is to enable Credential Guard; machines already running it were never exposed to this change in the first place. The durable fix is to end the dependence on MS-CHAPv2 single sign-on in 802.1X environments, for example by migrating to certificate-based EAP-TLS, and the retirement roadmap guarantees the registry escape hatch will eventually close.

Why it matters

This is the second consecutive month in which a routine Windows security update has disrupted enterprise sign-in infrastructure. September's KB5124008 turned on Credential Guard's Machine Identity Isolation in enforcement mode and left some domain-joined PCs unable to log in, as Joho no Todai reported at the time. One administrator in the current thread wrote that the patch went out untested because it was treated as an ordinary Patch Tuesday release, and asked when monthly updates started shipping changes of this magnitude.

The direction of travel is defensible: NTLMv1 is obsolete cryptography and retiring it is overdue. But announcing a change in documentation and having operations teams ready for it are different things, and two months of broken authentication suggest a structural problem in how these default changes are delivered. Administrators running 802.1X with MS-CHAPv2 now face a practical deadline: test Credential Guard, plan a move to EAP-TLS, and assume the next default flip will do exactly what this one did.