NTLMv1

The Windows security update scheduled for October 2026 will block requests using the outdated NTLMv1 security protocol. The BlockNtlmSSO registry value governs this change; if unset, Windows will default to Enforce mode, blocking NTLMv1-derived credentials. Administrators can temporarily set this value to 0 to allow NTLMv1, but Microsoft warns this reduces security. The deprecation of NTLM was first announced in 2024, with audit logs for NTLMv1 usage introduced in August 2025. NTLM was first introduced in 1993, and while it has been removed from Windows 11 24H2 and Windows Server 2025, traces remain in certain configurations. Credential Guard must be enabled, and the BlockNtlmSSO value must not be set to Audit mode for NTLMv1-derived credentials to be allowed. Microsoft aims to eliminate NTLM entirely, and the upcoming update signals the need for organizations to accelerate their transition away from NTLMv1.