Windows October 2026 Update Broke Wi-Fi or VPN? The NTLMv1 Change Explained

If your work laptop stopped connecting to the office Wi-Fi or the corporate VPN this week, you're far from alone. Microsoft's October 13, 2026 Patch Tuesday, a huge release that patches 1,413 vulnerabilities including an actively exploited zero-day, also changes a security default. Windows now blocks NTLMv1-derived single sign-on by default, and that breaks some networks that still use MS-CHAPv2 authentication. Microsoft says this is intentional, not a bug. The same update fixes a separate Always On VPN problem introduced in September. Here's how to tell which one you've hit and what to do about it.

Two Different VPN Problems

So the October update fixes one VPN problem and causes another for a particular set of networks.

The NTLMv1 Change: Who's Affected

NTLMv1 is a decades-old Windows authentication protocol with well-known cryptographic weaknesses. Captured NTLMv1 exchanges can be cracked relatively easily. MS-CHAPv2, which many enterprise Wi-Fi and VPN setups use to check usernames and passwords against a RADIUS server, relies on credential material derived from NTLMv1 when Windows does single sign-on. Block that, and those logins fail.

You're most likely affected if your organization uses:

• PEAP-MSCHAPv2 for WPA2/WPA3-Enterprise Wi-Fi with your Windows login
• 802.1X wired Ethernet with the same method
• VPNs that use MS-CHAPv2 with Windows SSO credentials

Home Wi-Fi with a normal WPA2/WPA3 password (Personal mode) isn't affected.

Symptoms to Look For

• Corporate Wi-Fi keeps asking for credentials, or says "Can't connect to this network," right after the update
• Wired network shows "Authentication failed" at your desk
• VPN rejects credentials that worked last week
• Admins see Event ID 4025 and related NTLM events in the logs

Fixes for IT Admins

Short term: restore Audit mode

Set the BlockNtlmv1SSO registry value to 0 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. That puts the behaviour back in audit mode while you migrate. Treat it as temporary: it keeps a weak protocol alive.

Long term: move to certificates

Microsoft recommends moving Wi-Fi and VPN authentication from MS-CHAPv2 to certificate-based methods such as EAP-TLS or PEAP-TLS. They resist credential theft and don't depend on NTLM at all.

For the Always On VPN bug

Install KB5127648 / KB5127646. If you can't patch yet, set the Always On VPN profile to a single protocol (SSTP only or IKEv2 only) instead of automatic selection.

What Regular Users Should Do

1. Don't roll back the update yourself. It fixes an actively exploited vulnerability.
2. Tell IT that the problem started after the October 13 update and mention "NTLMv1 / MS-CHAPv2." That's the quickest route to a fix.
3. Use a wired or hotspot connection in the meantime if your company allows it.

Does This Affect Consumer VPN Apps?

Generally, no. Consumer VPN apps that use WireGuard® authenticate with public/private key pairs, not Windows passwords or MS-CHAPv2. This change is a good illustration of why modern protocols moved away from password-based handshakes. Our VPN protocols guide explains the differences. If a VPN on your phone is misbehaving, that's a different issue; try our VPN not connecting fixes.

Frequently Asked Questions

Related Articles