KB5127648 - patch creating domain authentication issues in wireless connectivity

KB5127648 now documents an authentication hardening change that can affect enterprise Wi‑Fi using MS-CHAPv2; keep the registry change only as a temporary exception, confirm the match through NTLM event 4025, and submit the incident through Feedback Hub for Microsoft tracking.

Documented behavior

Starting with KB5127648 on Windows 11 versions 24H2, 25H2, and 26H2, Windows changes the internal default for BlockNtlmv1SSO from Audit to Enforce when:

• Credential Guard is disabled.
• BlockNtlmv1SSO was not explicitly configured.
• The connection uses MS-CHAPv2-based authentication, including PEAP-MSCHAPv2 or EAP-MSCHAPv2.

Enforce mode blocks NTLMv1-derived credentials used for single sign-on and can affect Wi‑Fi, Ethernet, and VPN connections.^1^

This is a security behavior change, although it is not listed as a separate Wi‑Fi defect in the update’s Known issues section. Microsoft’s detailed NTLM guidance documents the affected authentication methods and mitigation.^2^

Confirm that this is the same issue

Because the registry change already restored connectivity, do not repeat it. Instead, verify the original failure on an affected test device or from retained event logs:

1. Open Event Viewer.
2. Go to Applications and Services Logs → Microsoft → Windows → NTLM → Operational.
3. Check events at the failed connection timestamp:
   • Event ID 4025: NTLMv1-derived SSO credentials were blocked by policy. This confirms the KB5127648 behavior.
   • Event ID 4024: the same dependency was audited but allowed, indicating Audit mode.
4. Confirm that the wireless profile or RADIUS/NPS policy uses PEAP-MSCHAPv2 or EAP-MSCHAPv2.
5. Correlate it with:
   • Client: Applications and Services Logs → Microsoft → Windows → WLAN-AutoConfig → Operational
   • NPS server: Windows Logs → Security, particularly rejected connection event 6273 and its Reason Code.^3^

If event 4025 is absent, collect the WLAN profile, EAP method, failure timestamp, WLAN-AutoConfig event, and NPS rejection reason before attributing the failure to KB5127648.

Mitigation and permanent remediation

The documented temporary exception is:

• Registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
• Value: BlockNtlmv1SSO
• Type: REG_DWORD
• Data: 0 for Audit mode

No restart is required after changing this value. However, Audit mode reduces the protection supplied by Enforce mode and should be scoped narrowly and retained only while the authentication dependency is remediated.^2^

For the permanent resolution:

1. Inventory profiles generating event 4024 or 4025.
2. Identify every Wi‑Fi, wired 802.1X, and VPN policy using MS-CHAPv2.
3. Plan migration away from authentication flows requiring NTLMv1-derived SSO credentials, such as moving enterprise Wi‑Fi to an appropriate certificate-based EAP design.
4. Test with BlockNtlmv1SSO=1 on a controlled device.
5. Remove the temporary exception after all affected authentication paths pass testing.

Do not uninstall or permanently defer the security update as the primary remedy.

Report the incident to Microsoft

Microsoft Learn Q&A is community support and does not create a Windows engineering incident. Submit the reproduction through Feedback Hub:

1. Press Windows key + F.
2. Search for an existing report concerning KB5127648 PEAP-MSCHAPv2/802.1X authentication and upvote it, or select Report a problem.
3. Include the Windows edition/version and OS build, EAP method, Credential Guard state, registry value before and after mitigation, Event IDs 4025/4024, WLAN-AutoConfig events, and NPS event 6273 Reason Code.
4. Select Recreate my problem on a test device and attach diagnostics, excluding credentials and other sensitive information.
5. Save the Feedback Hub link for tracking and provide it through your Microsoft support channel if direct investigation is required.^4^

References

1. October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100. ...
2. Manage NTLMv1 changes and prevent network authentication issues in ...
3. Advanced troubleshooting 802.1X authentication
4. Send feedback to Microsoft with the Feedback Hub app | Microsoft Support