KB5127648 Breaks Wireless (and Wired) MS-CHAPv2 Authentication on Windows 11

Published: October 15, 2026
Applies to: Windows 11 versions 24H2, 25H2, and 26H2 (and Windows Server 2025 in related scenarios)
Severity: High for environments using PEAP-MSCHAPv2 / 802.1X Enterprise authentication

Summary

The October 2026 cumulative security update KB5127648 (released October 13, 2026) changes the default behavior of NTLMv1-derived credential handling on Windows 11. As a result, domain-joined devices can no longer complete single sign-on (SSO) authentication for networks that rely on MS-CHAPv2, most commonly PEAP-MSCHAPv2 used by WPA2-Enterprise Wi-Fi and wired 802.1X.

This is an intentional security hardening change that Microsoft previously announced, not an accidental regression. A registry workaround restores connectivity while keeping the update installed. The recommended long-term solution is to migrate away from password-based MS-CHAPv2 authentication.

Affected Configurations

The issue affects devices where all of the following are true:

• Windows 11 version 24H2, 25H2, or 26H2 with KB5127648 installed
• Credential Guard is disabled
• The registry value BlockNtlmv1SSO has not been explicitly configured
• The device is domain-joined and uses MS-CHAPv2 for SSO (commonly PEAP with the MS-CHAPv2 inner method)

Commonly broken scenarios

• WPA2-Enterprise (802.1X) Wi-Fi using PEAP-MSCHAPv2 with “Use my Windows user account”
• Wired Ethernet 802.1X authentication using PEAP-MSCHAPv2
• Some VPN connections that rely on MS-CHAPv2 SSO

Not affected

• WPA2-Personal or WPA3-Personal (PSK) networks
• EAP-TLS (certificate-based) authentication
• Manual entry of domain username and password
• Devices with Credential Guard enabled
• Devices where BlockNtlmv1SSO was already set

Symptoms

• The wireless or wired connection attempts to authenticate but fails to complete.
• Event Viewer typically shows:
  • WLAN-AutoConfig Event ID 12013 with error 0x80070285
  • WLAN-AutoConfig Event ID 12014 (“OneX Held State timeout”)
• The authentication request often never reaches the RADIUS/NPS server.
• Uninstalling KB5127648 restores connectivity; reinstalling breaks it again.
• Manually entering credentials (instead of using the logged-on user or computer account) succeeds.

Root Cause

Microsoft has been gradually phasing out NTLMv1. While the NTLMv1 protocol itself was removed from Windows 11 24H2 and later, remnants of NTLMv1 cryptography are still used by MS-CHAPv2 in domain-joined SSO scenarios.

In August 2025, Microsoft introduced the registry value BlockNtlmv1SSO and began auditing its use (Audit mode). With the October 2026 security update, the internal default changed from Audit mode to Enforce mode on eligible devices where the value is not set.

In Enforce mode, Windows blocks the generation of NTLMv1-derived credentials required for SSO. This causes PEAP-MSCHAPv2 authentication to fail locally before a packet is sent to the RADIUS server.

Microsoft documented the planned change in KB5066470 (“Upcoming changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025”) and later added a note to the KB5127648 article confirming the impact on Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2.

Temporary Workaround (Registry)

To restore Audit mode and re-enable MS-CHAPv2 SSO while keeping KB5127648 installed, set the following registry value:

Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Name: BlockNtlmv1SSO
Type: REG_DWORD
Value: 0 (Audit mode)

PowerShell (elevated)

New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" `
  -Name "BlockNtlmv1SSO" -PropertyType DWord -Value 0 -Force

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
"BlockNtlmv1SSO"=dword:00000000

Notes:

• Most administrators report that a reboot is not required, though some environments benefit from one.
• Setting the value to 0 restores the previous Audit mode behavior and logs Warning Event ID 4024 in the Microsoft-Windows-NTLM/Operational log.
• Setting the value to 1 enforces the block and logs Error Event ID 4025.
• This change can be deployed via Group Policy Preferences, Intune, or configuration management tools.
• Treat this as a temporary exception. Document the reason, monitor the audit events, and plan remediation.

Recommended Long-Term Fixes

1. Migrate to certificate-based authentication
   Move from PEAP-MSCHAPv2 to EAP-TLS (or TEAP with TLS). This eliminates the dependency on NTLMv1-derived credentials and is Microsoft’s recommended direction.
2. Enable Credential Guard
   Devices with Credential Guard enabled are unaffected by this change because the stronger protections are already enforced.
3. Identify remaining dependencies
   Use the Microsoft-Windows-NTLM/Operational log (Event IDs 4024 and 4025) to find systems still relying on NTLMv1-derived SSO credentials before fully enforcing the block.

Additional Information

• Update details: KB5127648 is the October 13, 2026 cumulative update for Windows 11 24H2 (build 26100.9711), 25H2 (build 26200.9711), and 26H2 (build 26300.9711).
• Official references:
  • KB5127648 release notes (Microsoft Support)
  • KB5066470 – Upcoming changes to NTLMv1 in Windows 11 version 24H2 and Windows Server 2025
• Microsoft has stated that this is a planned security hardening change and not a bug in the update.
• Uninstalling the update restores the old behavior but removes all other security and quality fixes included in the October 2026 release.

Conclusion

KB5127648 deliberately tightens NTLMv1 handling and, as a side effect, breaks SSO for environments still using PEAP-MSCHAPv2 on domain-joined Windows 11 devices. The registry workaround (BlockNtlmv1SSO = 0) provides immediate relief while the update remains installed. Organizations should treat the workaround as temporary and prioritize migration to EAP-TLS or enablement of Credential Guard.