KBY Technologies Logo
Passed (October 2026)MicrosoftEnforcementVendor gives the month only

NTLMv1-derived credentials for single sign-on restricted by default

WindowsWindows Server

Who is affected
Windows 11 (24H2, 25H2, 26H2) and Windows Server 2025 devices with Credential Guard disabled that connect to Wi-Fi, Ethernet or VPN using MS-CHAPv2. Single sign-on to those networks can fail.
What to do
  1. Find Wi-Fi, wired 802.1X and VPN profiles that use MS-CHAPv2 (PEAP-MSCHAPv2).
  2. Move them to certificate-based authentication, for example EAP-TLS with Intune-issued certificates.
  3. Use the temporary allow-and-audit registry setting in KB5066470 only while you migrate.
Source
Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard“Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025, enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Each date is quoted from the vendor’s own page. Dates move; check the source before you act.

Calendar feed for these products (.ics)

Other upcoming deadlines for these products

  1. 10 Nov 2026Tomorrow
    Windows 11, version 23H2 Enterprise and Education reach end of updatesEnd of support
  2. January 2027In 53 days
    ReFS volumes on removable media: enforcement phaseEnforcement
  3. 12 Jan 2027In 64 days
    Windows 10 Enterprise LTSC 2021 reaches end of updatesEnd of support
  4. 12 Jan 2027In 64 days
    Windows Server 2016 (and WSUS on it) reaches end of updatesEnd of support
All admin deadlines