Windows 11's October 13 update can stop work Wi-Fi and VPN from signing you in automatically; one registry value decides it

Microsoft’s release notes for KB5127648 (OS builds 26300.9711, 26200.9711 and 26100.9711) put the change in one line: “Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO).” It “applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication.”

The companion support article fills in the rest. The setting is a REG_DWORD named BlockNtlmv1SSO under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. At 0, NTLMv1-derived single sign-on is “audited but allowed to succeed”; at 1, it’s blocked. “A device restart isn’t required after you change the BlockNtlmv1SSO.” The connections at risk are the domain-joined PEAP-MSCHAPv2 and EAP-MSCHAPv2 setups many offices still use for Wi-Fi and VPN.

When a sign-in is stopped, Windows logs event 4025 in the NTLM operational log: “An attempt to use NTLMv1-derived credentials for Single Sign-On was blocked due to policy.” Under Audit mode the same attempt logs a 4024 warning instead, which is how admins were meant to find these machines over the past year.

Defaults that change from logging to blocking tend to surface every old dependency at once, usually at the help desk on the Monday after Patch Tuesday. The machines that break are the ones nobody checked the audit log on, and the fix that holds is moving them to authentication that doesn’t lean on NTLMv1 at all.

What Microsoft hasn’t said is whether a later update removes the Audit option entirely, or when.