KB5127648 breaks wired 802.1X (PEAP) authentication on Windows 11 24H2

Summary

After installing cumulative update KB5127648 and rebooting, wired 802.1X authentication using PEAP fails on the client side. The client reports an internal authentication error and the request never reaches the RADIUS server. Uninstalling KB5127648 fully restores

wired authentication. Wireless 802.1X (WPA2-Enterprise) on the same machine is unaffected.

Environment

• OS: Windows 11, 24H2 — Build 26100 (BuildLabEx: 26100.1.amd64fre.ge_release.240331-1435)
• NIC: Intel(R) Ethernet Connection (6) I219-V
• Authentication: Wired 802.1X, EAP type = PEAP, domain user credentials
• Wired 802.1X profile is pushed via domain Group Policy (WiredL2 GPO) — shared by many domain machines
• Affected update: KB5127648 (installed alongside KB5127690 and KB5127647)

Impact

• All domain machines with the GPO wired 802.1X policy + KB5127648 lose wired network access ("connected, not authenticated").
• A 600-second block timer causes a repeating failure loop.

Steps to Reproduce

1. Domain-joined Win11 24H2 client, wired 802.1X with PEAP, domain credentials.
2. Confirm wired auth works (baseline).
3. Install KB5127648, reboot.
4. Attempt wired 802.1X authentication.

Expected

Wired PEAP auth succeeds; EAP request relayed to RADIUS; client authorized.

Actual

Auth fails locally on the client before the request reaches RADIUS.

Event sequence (Microsoft-Windows-Wired-AutoConfig/Operational):

15507 Network authentication attempt resumed

15503 Wired 802.1X authentication started

15504 Authentication restarted - reason: "Onex Held State timeout"

15514 Wired 802.1X authentication FAILED

       Reason:     0x50005

       ReasonText: There was an internal authentication error.

       ErrorCode:  0x80070285

15506 Authentication suspended - reason: "Explicit Eap failure received"

       BlockingTime: 600

Key Evidence

1. The update replaced exactly the components that fail — these binaries were rewritten to 10.0.26100.9711 at install time (2026-10-13 22:14–22:15), while unrelated components stayed on the older Feb build:

dot3svc.dll .9711 2026-10-13 22:14:28 (wired 802.1X service)

dot3msm.dll .9711 2026-10-13 22:14:28 (wired 802.1X state machine)

dot3api.dll .9711 2026-10-13 22:14:28

dot3cfg.dll .9711 2026-10-13 22:14:28

dot3gpui.dll .9711 2026-10-13 22:14:28

onex.dll .9711 2026-10-13 22:15:05 (802.1X / OneX auth engine)

wlansvc.dll .9711 2026-10-13 22:15:05

wlanmsm.dll .9711 2026-10-13 22:15:46

2. Failure is client-side, before RADIUS — RADIUS has no record for this client at the failure time (checked by username + MAC). With 0x80070285 (ERROR_INTERNAL_ERROR) and "Onex Held State timeout", the PEAP handshake aborts on the client.
3. Wireless 802.1X on the same machine still works — only the wired (dot3) path is broken.
4. Uninstalling the update fixes it — wusa /uninstall /kb:5127648 + reboot restores auth; reinstall reproduces the failure.

Code decode

• 0x50005: EAP authentication failed (internal).
• 0x80070285: Win32 ERROR_INTERNAL_ERROR (0x285 / 645).
• 15506 "Explicit Eap failure received": client entered held state; since RADIUS logged nothing, the EAP-Failure originates before the RADIUS exchange.

Workaround

Uninstall KB5127648 and reboot. (May require rolling back the KB5127690 / KB5127647 batch on some machines.)

What we could NOT determine

No source-level insight into the specific code change. We can prove: the update replaced the exact failing modules, exact timing correlation, request never reaches RADIUS, and uninstall deterministically fixes it. We cannot state which internal code path regressed.

Request

Please confirm whether this is a known regression in KB5127648 affecting wired 802.1X / PEAP, and provide a fix or guidance for enterprise environments deploying wired 802.1X via Group Policy.