October 2026 Windows Updates Can Break Wi-Fi, VPN, AD FS

ProIT NW, a senior-led Microsoft consultancy in Seattle serving the regulated mid-market, is flagging three hardening changes that take effect with the October 2026 Windows security updates and can break things in hybrid shops: Wi-Fi and VPN sign-in that relies on MS-CHAPv2, OAuth sign-in through AD FS, and Remote Desktop to machines under Administrator protection. None of the three changes is a bug, though the Administrator protection rollout has a known Remote Desktop issue. Each is Microsoft closing an old permissive default, which is why each one lands as a surprise on the environment that never revisited its original setup.

1. NTLMv1-derived single sign-on is now blocked by default

Symptom

Wi-Fi, Ethernet, or VPN connections that use MS-CHAPv2 fail to connect through Single Sign-On. The classic example in a mid-market shop is the plant-floor or clinic Wi-Fi network built years ago on PEAP-MSCHAPv2 with domain credentials. Per KB5066470, manually entering credentials continues to work in Enforce mode, so users who type their credentials can still connect.

Cause

In its October 16, 2026 notice, "Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard," Microsoft says: "Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025, enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default." The change applies only on devices with Credential Guard disabled.

KB5066470 explains the mechanism. Updates released on and after October 13, 2026 change the internal default when the BlockNtlmv1SSO registry value is not set, so Windows uses Enforce mode (1) instead of Audit mode (0). Microsoft says remnants of NTLMv1 cryptography are still present in some scenarios, such as when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2 and EAP-MSCHAPv2, in a domain-joined environment. The KB covers Windows 11 versions 26H2, 26H1, 25H2, and 24H2, and Windows Server 2025.

The update does not create the registry value. It stays absent, and the new default applies. This is why you will not find a setting to "undo" in a normal audit.

Fix

Microsoft's direction: "Organizations should identify affected authentication configurations. Remove dependencies on MS-CHAPv2 and migrate Wi-Fi and VPN connections to certificate-based authentication." In practice:

• Look in the Microsoft-Windows-NTLM/Operational log. Event ID 4025 (Error) reads "An attempt to use NTLMv1-derived credentials for Single Sign-On was blocked due to policy." Event ID 4024 (Warning) is the audit-mode version of the same event.
• List every Wi-Fi profile, VPN profile, and RADIUS policy that uses PEAP-MSCHAPv2, EAP-MSCHAPv2, or MS-CHAPv2.
• Plan the move to certificate-based authentication for each, starting with the ones that carry production traffic.

Temporary escape hatch

The value lives at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 as BlockNtlmv1SSO, a REG_DWORD. Set to 0 (Audit), NTLMv1-derived credentials are allowed and warning events are generated. Set to 1 (Enforce), they are blocked and error events are generated. Microsoft says a device restart isn't required after you change it. Some press coverage printed the name as "BlockNtlmSSO"; that is wrong, and the correct name is BlockNtlmv1SSO.

Microsoft's wording on when to use 0: "If an organization identifies a critical authentication dependency that cannot immediately be migrated, setting BlockNTLMv1SSO to 0 (Audit) temporarily allows NTLMv1-derived Single Sign-On credentials while remediation is completed." It adds that Audit mode "reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception."

Keep it temporary because the exception re-opens the weakness the change exists to close, and an exception without an end date becomes the new baseline. Scope it to the devices that need it, record the owner and an end date, and keep the audit events on so you can see when the dependency is gone. NTLM is the next step of the same effort we covered in our Kerberos RC4 enforcement triage: Microsoft is retiring legacy authentication defaults one at a time.

2. AD FS now requires an exact OAuth redirect_uri match

Symptom

OAuth sign-ins through AD FS fail after the October update, with Event ID 364 and MSIS9224 in the AD FS Admin log.

Cause

Microsoft's AD FS FAQ (added October 23, 2026) says: "The October 2026 update changes AD FS to require an exact URI match for the OAuth redirect_uri parameter (RFC 6749 §3.1.2.3). Previously AD FS used prefix matching, which allowed sub-paths, case variations, and wildcard-derived URIs to be accepted. These patterns are now correctly rejected."

Fix

The FAQ is explicit: "All fixes are client registration changes only — no server patch or configuration change is needed." The Event ID 364 message includes the exact redirect_uri that was rejected and the client ID, which identifies the registration to update with Set-AdfsClient or Set-AdfsNativeClientApplication. Beyond reacting to events, you can get ahead of it:

• Inventory every OAuth client registered in AD FS.
• Compare each registered redirect URI to what the application actually sends. Trailing slashes, letter case, and sub-paths are the usual differences.
• Correct the registration so the two match exactly.

Temporary escape hatch

The FAQ describes only client-registration fixes. The "workaround" is the fix itself: register the exact URI the app sends. If a vendor application cannot send a stable URI, that is a vendor conversation to start now. It is also one more reason to put AD FS to Entra ID migration on the roadmap, though it is a reason to plan rather than to rush.

3. Administrator protection is on by default in the Windows 11 baselines

Symptom

Non-admin users might be unable to establish Remote Desktop connections to Windows 11 devices that have Administrator protection enabled, with error 0xC000000D.

Cause

In its October 13, 2026 notice, "Manage Administrator protection within Windows 11 security baseline," Microsoft says: "If your organization uses Windows security baselines, Administrator protection becomes enabled by default with the October 2026 Windows security update." It applies to the Windows 11 baselines for versions 26H2, 25H2, and 24H2.

The Windows 11 25H2 release health page lists a known issue, "Remote Desktop connections might fail for non-admin users with error 0xC000000D," status Mitigated, last updated October 13, 2026. Microsoft says non-admin users "might be unable to establish Remote Desktop connections to remote devices that have Administrator protection enabled." The issue originates with the September preview update KB5124010 or later updates, and Microsoft says it is working to address it in a future Windows update.

Fix

Microsoft's instruction: "Review and test your security baseline configuration and adjust it as appropriate for your environment. Use Microsoft Intune or Group Policy to manage Administrator protection enablement as part of the security baseline." Before the baseline reaches production devices, test on a pilot group, especially the Remote Desktop paths your non-admin users take to reach devices with Administrator protection.

Temporary escape hatch

Microsoft's instruction is to "use Microsoft Intune or Group Policy to manage Administrator protection enablement as part of the security baseline." Any adjustment belongs there, where it is visible and reversible. Name the reason in your change record and revisit it when Microsoft ships its fix. Leaving a protection off permanently because Remote Desktop was inconvenient is the outcome to avoid.

Triage order for this week

1. Wi-Fi and VPN tickets. Pull help-desk tickets about wireless or VPN failures since October 13. On a few affected devices, check Microsoft-Windows-NTLM/Operational for Event IDs 4024 and 4025.
2. MS-CHAPv2 inventory. List every Wi-Fi, VPN, and RADIUS profile using PEAP-MSCHAPv2 or EAP-MSCHAPv2, ranked by business impact.
3. AD FS Admin log. Search for Event ID 364 and note each client ID and rejected redirect_uri.
4. Baseline assignment. Find which Windows 11 devices receive a security baseline, and test the Remote Desktop paths your non-admin users take to reach devices with Administrator protection.
5. Change log. Record any registry exception with an owner and an end date. In a regulated environment, an undocumented exception is the finding.

The 30-second version

Three hardening changes arrive with the October 2026 updates. NTLMv1-derived single sign-on is blocked by default on devices without Credential Guard, which can break MS-CHAPv2 Wi-Fi and VPN; move to certificate-based authentication, and use BlockNtlmv1SSO set to 0 only as a scoped, temporary exception. AD FS now needs an exact OAuth redirect_uri match; fix the client registrations, not the servers. Administrator protection is on by default in the Windows 11 baselines; test non-admin Remote Desktop access before you roll the baseline out. If you want a senior engineer to review your Wi-Fi, VPN, and AD FS dependencies, the project intake form takes about three minutes.

Sources and further reading

• Windows message center (NTLMv1 hardening, Oct 16, 2026; Administrator protection baseline, Oct 13, 2026)
• KB5066470 — NTLMv1 hardening
• AD FS FAQ (redirect_uri guidance, added Oct 23, 2026)
• Windows 11 25H2 release health
• Kerberos RC4 enforcement triage

Pro IT NW handles identity, security, and Microsoft 365 work for the regulated mid-market in Seattle and the Pacific Northwest. Vendor-neutral, labor-only. This alert relays Microsoft's published guidance; confirm current steps in the linked sources before you act, as Microsoft may revise them.