The change hinges on the BlockNtlmSSO registry value. If administrators have not set it, Windows now uses Enforce mode (1) rather than Audit mode (0). The update does not change the value itself, so setting it to 0 temporarily restores NTLMv1-derived Single Sign-On, though Microsoft cautions that Audit mode "reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception."

This is by design, not a bug. Microsoft put NTLM on its deprecation list in 2024, added audit logs for NTLMv1 usage in late August 2025, and said in 2023 that its end goal was "eliminating the need to use NTLM at all." The protocol dates back to 1993 and Windows NT 3.1, and it is somewhat insecure by modern standards, but it has proved stubbornly hard to remove from enterprise environments.

Remnants persist notably in MS-CHAPv2-based connections, including PEAP-MSCHAPv2 and EAP-MSCHAPv2, in domain-joined environments, which is why audit mode was introduced to help administrators find remaining usage. If Credential Guard is not enabled and BlockNtlmSSO is not set to Audit mode, NTLMv1-derived credentials are now blocked as Microsoft works "to finalize the disablement of NTLMv1."

There is no indication how long the Audit mode workaround will keep working, most likely until the next major Windows release. Microsoft said in September that in-market versions of Windows client and Server will continue to support NTLM, but its long-term objective remains a platform that does not need it at all. Networking trouble after the update may simply mean migration plans are less complete than administrators believed.