KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

Supply-PWC 101 Reputation points
2026-10-13T22:26:53.5766667+00:00

After installing KB5127648, Windows 11 clients can no longer authenticate to our WPA2-Enterprise (802.1X/PEAP) wireless network. Authentication starts but never completes (Event 12014: OneX Held State timeout). WPA2-Personal networks continue to work. The issue reproduces across multiple hardware vendors and wireless chipsets. Uninstalling KB5127648 immediately restores connectivity. Has anyone else observed this with PEAP-based 802.1X environments?

Windows for business | Windows Client for IT Pros | Networking | Other

20 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Gerard Igoe 21 Reputation points
    2026-10-16T16:56:12.2933333+00:00

    So reading around we need to create a key in the registry?

    Others have posted this and wondering if this helped anyone.

    New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name 'BlockNtlmv1SSO' -Value 0 -PropertyType DWord -Force

    Was this answer helpful?

    0 comments
  2. McKee, David S 0 Reputation points
    2026-10-16T16:17:54.5133333+00:00

    We are not seeing any issues with the patch installed and no registry entries exist for the workaround. From my understanding if you have credential guard enabled in security the problem doesn't exist for Windows 11 25H2

    Microsoft has removed the NTLMv1 protocol (see Removed features and functionality) from Windows 11, version 24H2 and Windows Server 2025 and later versions. However, while the NTLMv1 protocol is removed, remnants of NTLMv1 cryptography are still present in some scenarios, such as when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2, in a domain-joined environment.

    Beginning with Windows updates released in August 2025, Audit mode was introduced to help administrators identify dependencies on NTLMv1-derived credentials before enforcement.

    Credential Guard provides complete protection of both NTLMv1 legacy cryptography and many other attack surfaces, and thus Microsoft strongly recommends its deployment and enablement if Credential Guard’s requirements are met. The changes outlined in this article only affect devices where Credential Guard is disabled; if Windows Credential Guard is enabled on the device, these changes do not take effect.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Scott Dale 0 Reputation points
    2026-10-16T13:43:56.87+00:00

    Same issue here,

    Looking at the NPS logs the machines are passing the mac address as the FQ account name ie Domain\f4a8fda6g660 instead of the machine name Domain\Desktop-PC and trying to use EAP instead of PEAP.

    As the Mac addresses are not set as accounts up it just fails with "The specified user account does not exist."

    Was this answer helpful?

    0 comments
  4. Virginie Truchet 0 Reputation points
    2026-10-15T09:11:27.3966667+00:00

    We're also affected and in addition, we encounter issue with Windows Hello For Business : we cannot use anymore the Pin code, fingerprints and face ID to authenticate. Uninstalling KB5127648 does not fixe the issue.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. Ben Green 11 Reputation points
    2026-10-15T07:31:37.75+00:00

    Microsoft have just advised in 365 Message center - Message ID MC1508562

    Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard

    Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025 enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default. This planned security-hardening change is part of the boarder Microsoft effort to phase out NTLM. Microsoft originally documented the change in August 2025. This change applies only on devices with Credential Guard disabled, and might cause issues with Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2 authentication, resulting in possible failure to connect via Single Sign-On pathways...

    It links to https://support.microsoft.com/help/5066470

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.