Since the 13 October 2026 cumulative update (KB5127648 on Windows 11, KB5126646 on Windows Server 2025), a lot of office PCs stopped joining WPA2/WPA3-Enterprise Wi-Fi, wired 802.1X and VPN automatically. Typing the password by hand still works. One Microsoft Q&A thread has 400+ people clicking "same question".

What changed

Microsoft is hardening NTLMv1 (message center post MC1508562). From the October update, if this registry value is not set:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 BlockNtlmv1SSO

Windows treats it as Enforce (1) instead of Audit (0) and blocks NTLMv1-derived single sign-on credentials. PEAP with EAP-MSCHAPv2, signing in with the Windows logon, is exactly that, so those profiles fail.

Not affected:

  • devices with Credential Guard running;
  • certificate-based profiles (EAP-TLS, PEAP-TLS);
  • PSK networks;
  • users who type their credentials.

That's why only some PCs and some networks break.

Find the affected PCs

Look for event 4025 in Applications and Services Logs → Microsoft → Windows → NTLM → Operational. To check many machines at once, I wrote a small read-only PowerShell script. It reads:

  • whether the update is installed;
  • BlockNtlmv1SSO;
  • whether Credential Guard is running;
  • each Wi-Fi and wired profile's EAP method and whether it uses the Windows logon;
  • event 4025.

It prints a verdict per profile and can write a CSV per PC:

.\Test-NtlmV1WifiImpact.ps1 .\Test-NtlmV1WifiImpact.ps1 -Csv \\server\share\ntlmv1-$env:COMPUTERNAME.csv 
Kind Profile Method UsesWindowsLogon Verdict Wi-Fi CorpWiFi PEAP + EAP-MSCHAPv2 True AFFECTED: PEAP-MSCHAPv2 with Windows logon credentials, Enforce mode

Script (MIT, changes nothing): https://github.com/Donrulezz/Test-NtlmV1WifiImpact

Get people back online today

Set the DWORD BlockNtlmv1SSO = 0 under the key above. For many PCs, use Group Policy Preferences (Computer Configuration → Preferences → Windows Settings → Registry) or an Intune script. Reconnect, or restart if it doesn't take effect.

This turns the weaker NTLMv1-derived sign-in back on. Treat it as a bridge and put a date on it. Uninstalling KB5127648 only lasts until the next cumulative update, which carries the same change.

Fix it for good

Move the affected networks to certificate-based sign-in:

  1. Issue device or user certificates (AD CS auto-enrolment, or Intune SCEP/PKCS).
  2. Add EAP-TLS (or PEAP with certificates) to the NPS network policy.
  3. Push the new Wi-Fi, wired or VPN profile to a pilot group.
  4. Roll it out, then remove PEAP-MSCHAPv2.

Or turn on Credential Guard where the hardware supports it. When you're done, remove the stop-gap value so NTLMv1 sign-in stays off.