KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

[ITGuyNW]

Happy patch tuesday everyone

 

KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11 - Microsoft Q&A

 

October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711) | Microsoft Support

 

Just disabled our rollouts so I can test it.

 

 

[andy_b]

argh just spent the morning looking at this...

[CrootUK]

Registry change does work, short term fix. Push for EAP-TLS here we come! 

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

BlockNtlmv1SSO

Reg_DWORD

0

Pushing it in GPO does seem to retain after the update is applied too..

 

Upcoming changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025 | Microsoft Support Note the timeline on this page

Date	Change
Late August 2025	Auditing logs for NTLMv1 usage enabled on Windows 11, version 24H2 and newer clients.
November 2025	Begin rollout of changes to Windows Server 2025.
October 2026	The default value of the BlockNtlmv1SSO registry key is changed from Audit mode (0) to Enforce mode (1) through a future Windows update, strengthening NTLMv1 restrictions. This change in defaults only takes effect if the BlockNtlmv1SSO registry key has not been deployed.

Edited 12 hours ago by CrootUK

[BKGarry]

Ah this may be why I have a smartcard failback one in my Group Policies, I know I put that in because something weird with the PEAP one wouldn't work on HPs we got where the smartcard did, but I also have a delay on Quality Updates by 5 days, which I think has saved me a bit this morning

 

I may put our PSK one in as a fallback just in case though

[synaesthesia]

And another shining example as to why all windows updates with exception to zero day security patches should have a decent cooling off period (2 weeks imo) before being installed, automatically or otherwise. Instant installation in the name of any supposed requirements is absolutely insane, unfortunately. We should be able to rely on them being fully tested before hitting shelves, but at the same time we know testing often never begins until hitting the general populace

 

[sigma]

23 minutes ago, synaesthesia said:

And another shining example as to why all windows updates with exception to zero day security patches should have a decent cooling off period (2 weeks imo) before being installed, automatically or otherwise. Instant installation in the name of any supposed requirements is absolutely insane, unfortunately. We should be able to rely on them being fully tested before hitting shelves, but at the same time we know testing often never begins until hitting the general populace

 

100% agree.
In education, availability of services is paramount, and so even when you do roll out Microsoft (or anybody else’s) updates, they should be tested on devices that “get worked”, but will cause minimal disruption if they break things, which they will from time to time. When they are proved solid in your establishment, only then should they be rolled out site wide.

It’s nothing new, having been the approved method for at least the last 40 years when it was IBM rather than Microsoft.

[ITGuyNW]

I use GPO to put in a 7 day delay, with another 5 day grace period. It's usually enough time to see who braved them first.

[psydii]

Didn't this break in 24h2 by default?

[BKGarry]

10 minutes ago, psydii said:

Didn't this break in 24h2 by default?

Wasn't this you had to explicitly allow your certificate server in the settings in group policy?

 

[psydii]

Machine account based PEAP definitely broke for us at one point a while ago.  Maybe there was another way to fix it, but we rolled out eapTLS because we happened to have all the pieces lined up and ready to go?

[DrCheese]

1 hour ago, psydii said:

Machine account based PEAP definitely broke for us at one point a while ago.  Maybe there was another way to fix it, but we rolled out eapTLS because we happened to have all the pieces lined up and ready to go?

 

If you ever turned on credential guard it broke this, even if you reimaged a machine (It held on) so that might have been it - Was why I switched over to EAP-TLS in the past (I found out on a laptop the hardway :P)

[pete]

When you're rolling out EAP-TLS to fix this (unticking MS-Chapv2 in the radius server conf may also give you a stopgap fix) make sure the device cert renewal window is longer than your summer hols.