Windows 11 update KB5127648 stops 802.1X single sign-on by enforcing NTLMv1 blocking
Windows 11 update KB5127648 switched NTLMv1 blocking to Enforce and broke 802.1X PEAP single sign-on on enterprise Wi-Fi and wired networks. Setting BlockNtlmv1SSO to 0 restores sign-on for now, but the retirement plan stays, so teams need an EAP-TLS schedule.
The Engineer · Build desk
Timeline. August 2025: Microsoft's roadmap says 24H2 and later removed NTLMv1, but single sign-on still used NTLMv1-derived credentials. September 2025: Audit mode logs each use of them. October 2026: updates change the default from Audit to Enforce; KB5127648 arrives.
| Date | Event | Claim |
|---|---|---|
| August 2025 | Roadmap: 24H2 removed NTLMv1, but SSO kept derived credentials | 5 |
| September 2025 | Audit mode logs an event when NTLMv1-derived credentials are used | 6 |
| October 2026 | Updates switch the default from Audit to Enforce; KB5127648 arrives | 7 |
What happened
- The Microsoft Q&A thread on the failure has drawn more than 90 'Same question' responses, including from administrators in Chinese-speaking regions.
- Authentication starts but stops at Event 12014, an OneX Held State timeout. WPA2-Personal is unaffected, and the fault reproduces on Intel and Qualcomm wireless chipsets.
- Several administrators independently confirmed that uninstalling KB5127648 restores connectivity and reinstalling it brings the failure back.
- Joho no Todai found no 802.1X or PEAP known issue in the KB5127648 release notes, and a community adviser found no entry on the release health page.
Why it matters
- cost Until the registry value is pushed, every affected user has to clear 'Use Windows user account' and type domain\username and a password by hand.
- exposure Microsoft's documentation lists VPN connections alongside Wi-Fi and wired LAN, so MS-CHAPv2 VPN profiles sit under the same default even though the forum reports cover only Wi-Fi and wired.
- contradiction Microsoft's documentation describes this exact outcome, yet an admin who reads only the release notes and release health page finds nothing that explains the failure.
Only one path breaks, and the forum tests show which. Windows 11 24H2 and later removed the NTLMv1 protocol, but credentials derived from it stayed in single sign-on for MS-CHAPv2 authentication on Wi-Fi, wired networks and VPNs [5]. Enforce mode rejects single sign-on that uses those credentials [12]. Microsoft's documentation, as quoted by Joho no Todai, says: "single sign-on using MS-CHAPv2 authentication for Wi-Fi, wired LAN, and VPN connections will stop working, but authentication will succeed if credentials are entered manually" [9].
The forum results match that text. With "Use Windows user account" checked, authentication fails with WLAN-AutoConfig Event 12013 and error 0x80070285. With the box cleared and "domain\username" and a password typed in, it succeeds [10]. The reporter also confirmed that BlockNtlmv1SSO was unset both before and after the update [14]. The device ran on the default, and the default changed. In our view the evidence describes a documented default taking effect.
The warning window was long. Audit mode arrived with the September 2025 updates and logged an event each time these credentials were used [6]. Microsoft set the Enforce default for the October 2026 updates [7]. That is 13 months between the two [13]. KB5127648, released on October 13 local time, covers builds 26300.9711, 26200.9711 and 26100.9711 for versions 26H2, 25H2 and 24H2 [1].
The stopgap is a 32-bit DWORD named `BlockNtlmv1SSO`, set to 0, under `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0` [11]. More than 40 people marked that answer helpful, and some deployed it to multiple devices through Group Policy [11]. Zero is the Audit value [7]. A device set to 0 therefore goes back to logging each use of these credentials [6]. We'd treat that log as the migration inventory, because it is where the remaining MS-CHAPv2 single sign-on dependencies show up.
Joho no Todai writes that the plan to retire NTLMv1 remains in place, giving migration to options such as EAP-TLS a practical deadline [15].
What to watch
- Whether Microsoft adds an 802.1X or PEAP entry to the KB5127648 release notes or the release health page.
- Whether reports appear of MS-CHAPv2 VPN single sign-on failing under the same Enforce default.
- Any Microsoft statement on how long a BlockNtlmv1SSO value of 0 will be honored.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption30
- Hype gap+10
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
KB5127648 was released on October 13, local time, and covers builds 26300.9711 / 26200.9711 / 26100.9711 for Windows 11 versions 26H2, 25H2, and 24H2.
- [2]
The Microsoft Q&A thread on the failure has received more than 90 'Same question' responses, including from administrators in Chinese-speaking regions.
- [3]
According to the first reporter, authentication begins but stops at Event 12014 (OneX Held State timeout); WPA2-Personal is unaffected and the issue reproduces across wireless chipsets from multiple vendors, including Intel and Qualcomm.
- [4]
Multiple administrators independently verified that uninstalling KB5127648 immediately restores connectivity and reinstalling it brings the problem back.
- [5]
Microsoft's August 2025 roadmap says Windows 11 24H2 and later removed the NTLMv1 protocol itself, but NTLMv1-derived credentials remained in single sign-on for MS-CHAPv2 authentication on Wi-Fi, wired networks, and VPNs.
- [6]
The September 2025 updates first introduced Audit mode, which records an event whenever NTLMv1-derived credentials are used.
- [7]
Microsoft announced that the October 2026 updates would change the default from Audit (0) to Enforce (1); KB5127648 arrived in October 2026.
- [8]
Joho no Todai confirmed that, at the time of writing, Microsoft has not listed any known issue involving 802.1X or PEAP in the KB5127648 release notes, and an independent community adviser pointed out there is no corresponding entry on the official release health page.
- [9]
Microsoft's official documentation states that in Enforce mode, "single sign-on using MS-CHAPv2 authentication for Wi-Fi, wired LAN, and VPN connections will stop working, but authentication will succeed if credentials are entered manually".
- [10]
Forum testing found authentication fails with 'Use Windows user account' checked (WLAN-AutoConfig Event 12013, Error 0x80070285) but succeeds when it is unchecked and 'domain\username' and a password are entered manually.
- [11]
The first fix shared in the forum is to create a 32-bit DWORD named BlockNtlmv1SSO under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 and set it to 0; more than 40 people marked the answer helpful, and some deployed it across multiple devices through Group Policy.
- [12]
Enforce mode rejects single sign-on using NTLMv1-derived credentials.
- [13]
Audit mode (September 2025 updates) to the Enforce default (October 2026 updates) spans 13 months.
- [14]
The reporter verified that the BlockNtlmv1SSO registry value was unset both before and after the update.
- [15]
Returning BlockNtlmv1SSO to 0 restores operation for now, but the plan to retire NTLMv1 remains in place, giving preparations to migrate to options such as EAP-TLS a practical deadline.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toWindows 11 KB5127648 Disrupts Enterprise Wi-Fi by Changing the Default NTLMv1 Blocking Setting
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.