Laptops Stopped Joining Office Wi-Fi or VPN After the October Windows Update? Here's Why
Updated: 2 days ago
Short answer: The October 13, 2026 Windows security update (KB5127648 for Windows 11) turned on a block that Microsoft had been testing quietly since 2025. On Windows 11 version 24H2 and newer, laptops that don't have Credential Guard turned on can no longer reuse your Windows sign-in to log in to Wi-Fi, wired networks, or VPN when those networks use an older login method called PEAP-MSCHAPv2. Typing your username and password by hand still works. The lasting fix is moving the network to certificate-based sign-in (EAP-TLS), which you can roll out to laptops with Microsoft Intune.
What changed, in plain English
Many office networks are set up so a laptop joins the Wi-Fi or VPN using the same username and password you use to log in to Windows. Behind the scenes, a lot of those setups use a method called MS-CHAPv2 (usually PEAP-MSCHAPv2 or EAP-MSCHAPv2). That method still leans on leftovers of NTLMv1, a decades-old Windows login technology that attackers know how to crack.
Microsoft has been phasing NTLM out. Starting in 2025, Windows 11 24H2 and newer quietly logged a warning every time a laptop used those old credentials. With the October 13, 2026 update, the default flipped from "warn" to "block." In Microsoft's guidance on the NTLMv1 change, the company confirms the block affects Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2, and that manually entering credentials keeps working.
Who is affected
You're likely affected if all of these are true:
Your laptops run Windows 11 version 24H2, 25H2, or newer and installed the October 13, 2026 update.
Credential Guard is turned off. It's often off on Windows Pro machines, which is what most small firms buy. If Credential Guard is on, this particular change doesn't apply.
Your office Wi-Fi or VPN signs people in with their Windows username and password (often called "WPA2-Enterprise" or "802.1X") using PEAP-MSCHAPv2 or EAP-MSCHAPv2.
If your office Wi-Fi uses a single shared password, this change isn't your problem. Look elsewhere.
How to tell if this is what's happening
The laptop connected on its own before the update and now asks for a username and password, or just fails.
Typing the password manually gets it connected.
An IT person can check the Windows Event Viewer under Microsoft-Windows-NTLM/Operational for Event ID 4025, which means an NTLMv1-based sign-on was blocked. Event ID 4024 was the earlier "audit only" warning.
The quick workaround and why it's only temporary
The safest stopgap is to have people type their credentials when prompted. Microsoft also documents a registry setting (BlockNtlmv1SSO set to 0) that switches a laptop back to "warn only." Microsoft calls that a scoped, temporary security exception because it brings back the weakness the update closed. If your IT provider uses it, it should be limited to the affected machines, documented, and paired with a plan to remove it.
Please don't have staff edit the registry themselves, and don't turn off Windows updates to avoid the change. Skipping security updates creates a much bigger risk than a login prompt.
The real fix: certificate-based sign-in
The lasting answer is to stop relying on passwords to join the network at all. With certificate-based sign-in (EAP-TLS), each company laptop carries a digital certificate that proves it belongs on your network. People don't type anything, and there's no password for an attacker to steal or replay.
For firms on Microsoft 365, Microsoft Intune can deliver those certificates and the Wi-Fi and VPN profiles to every managed laptop, and it can remove them when someone leaves. That ties in well with a clean Microsoft 365 employee offboarding checklist. Your Wi-Fi equipment and VPN also have to be set up to accept certificates, so plan the change as a short project, not a single setting.
It's also worth asking whether Credential Guard can be turned on. Microsoft recommends it wherever the hardware supports it, because it protects stored credentials against many other attacks, not just this one.
This is part of a broader shift: Microsoft is retiring old password-based logins across the board. The same thinking is behind phishing-resistant sign-ins and newer threats like device code phishing.
What to do this week
Confirm the symptom: a laptop that used to connect on its own now asks for a password or fails.
Have affected staff type their username and password to get connected for now.
Ask your IT provider to check for Event ID 4025 and confirm which networks use PEAP-MSCHAPv2.
Keep Windows updates on. Don't roll back or pause the October update.
If a temporary registry exception is used, limit it to affected laptops and write down when it will be removed.
Plan the move to certificate-based sign-in (EAP-TLS), using Microsoft Intune for managed laptops.
Check whether Credential Guard can be turned on for your laptops.
Frequently asked questions
Why did our laptops stop connecting to Wi-Fi automatically after the October Windows update?
The October 13, 2026 Windows security update blocks Windows 11 24H2 and newer from reusing your Windows sign-in for Wi-Fi, wired, or VPN connections that use PEAP-MSCHAPv2 or EAP-MSCHAPv2, on laptops without Credential Guard. Those methods rely on old NTLMv1 cryptography that Microsoft is retiring.
Can we still connect by typing the password?
Yes. Microsoft confirms that manually entering credentials keeps working. Only the automatic single sign-on is blocked.
Should we uninstall the update to fix it?
No. The update also carries security fixes, and removing it leaves laptops exposed. Use manual sign-in for now and work toward certificate-based sign-in.
What is the permanent fix?
Move your Wi-Fi and VPN to certificate-based sign-in (EAP-TLS), with certificates delivered to company laptops through a tool like Microsoft Intune. Turning on Credential Guard where supported is also recommended.
Does this affect Wi-Fi with a shared password?
No. Networks that use one shared Wi-Fi password don't use this sign-in method, so they aren't affected by this change.
Need help getting your network back to "just works"?
24uNet helps small businesses in Colorado and Texas plan and roll out certificate-based Wi-Fi and VPN sign-in, manage laptops with Microsoft Intune, and keep Windows updates flowing safely. Our Microsoft 365 and network security services include 24/7 managed detection and response, with security analysts reviewing alerts.
Call our Denver office at (303) 468-5515 or our College Station office at (979) 256-5100, or email sales@24unet.com. We serve Denver, Colorado Springs, and Bryan–College Station. Contact us.
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. Cyber AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments