Description: After the October 13, 2026 Windows 11 update KB5127648, some enterprise Wi-Fi connections may stop signing in automatically. Learn which PEAP configurations are affected, how to check Event 4025, and which workarounds preserve security.
If your office Wi-Fi stopped connecting after KB5127648 but home Wi-Fi still works, check enterprise authentication first. Microsoft's October update changes the default handling of legacy credentials used for automatic sign-in. The change can affect Wi-Fi, wired networks and VPNs that use MS-CHAPv2. It does not mean every wireless adapter has failed.[1][2]
Why did an update change network access?
Windows previously logged certain NTLMv1-derived single sign-on requests and allowed them. The October 13 security update blocks them by default when Credential Guard is disabled and the BlockNtlmv1SSO registry value is absent. Domain-connected networks using PEAP-MSCHAPv2 or EAP-MSCHAPv2 can depend on that older sign-in flow. This is a security-hardening compatibility change, not proof of a defective Wi-Fi chip.[2]
| What you see | What it suggests | Safer next step |
|---|---|---|
| Office WPA2-Enterprise Wi-Fi fails; home Wi-Fi works | Check enterprise authentication | Contact your IT team |
| Entering credentials manually works | Consistent with blocked automatic sign-in | Use only the organization's approved prompt |
| Ethernet or VPN also fails at sign-in | May share the same legacy method | Report all affected connections together |
| Every Wi-Fi network drops signal | May be unrelated | Check radio, router and driver separately |
Verify the update and the error
Open winver to check for Windows 11 24H2, 25H2 or 26H2. After KB5127648, the corresponding builds are 26100.9711, 26200.9711 and 26300.9711. Find KB5127648 under Settings → Windows Update → Update history and note when the problem began.[1]
For administrators, open Event Viewer → Applications and Services Logs → Microsoft → Windows → NTLM → Operational. Event ID 4025 records a blocked attempt to use NTLMv1-derived single sign-on credentials; 4024 is the earlier audit warning. Event logs can contain account names, so do not post raw logs publicly.[2]
What can you do today?
Microsoft says manually supplying credentials can still work. Try the sign-in method approved by your organization. It may need repeating at later sessions. Some users on Microsoft Q&A reported that forgetting and rejoining the network restored access temporarily; that is a user report, not a guaranteed fix. On managed PCs, removing a Wi-Fi profile can discard settings needed for enrollment, so ask IT first.[2][3]
For a lasting solution, Microsoft recommends moving from MS-CHAPv2-based Wi-Fi/VPN authentication to certificate-based EAP-TLS or PEAP-TLS. The documented BlockNtlmv1SSO=0 audit setting is a temporary security exception that weakens the new protection. Only an administrator should assess and scope it; this article does not recommend applying a registry command on your own.[2][4]
Should you uninstall KB5127648 or reset Windows?
Uninstalling a security update also removes protections. First compare the connection type, update history and authentication logs. Avoid factory resets, mass deletion of certificates, clearing the TPM or resetting all network settings. Microsoft warns that clearing the TPM can make protected data permanently inaccessible.[4]
Status checked October 17, 2026: Microsoft documents the authentication change and the manual sign-in behavior. No broadly applicable subsequent fix for this specific automatic sign-in scenario was verified. Microsoft Q&A contains administrator reports across different hardware; those reports do not establish universal impact.[1][2][3]
Bottom line
If work Wi-Fi failed right after KB5127648, investigate the authentication method before touching the driver or wiping Windows. Check the build, ask IT about Event 4025, and use approved manual sign-in while administrators plan a stronger authentication method. Your laptop may be working exactly as updated; the old network sign-in is what needs attention.
References (4)
[1] Microsoft Support, “October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711)” (2026-10-13; change log 2026-10-15). https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update
[2] Microsoft Support, “Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025,” KB5066470 (original 2025-08-29; updated 2026-10-14). https://support.microsoft.com/en-au/servicing/os/windows/docs/2025/08/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025
[3] Microsoft Q&A, “KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi-Fi authentication on Windows 11” (user reports starting 2026-10-13; not an official confirmed universal defect). https://learn.microsoft.com/en-us/answers/questions/6036507/kb5127648-breaks-wpa2-enterprise-802-1x-peap-wi-fi
[4] Microsoft Learn, “Considerations and known issues when using Credential Guard” (2026-04-23). https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues
