Windows 11 KB5127648 Disrupts Enterprise 802.1X Sign-In
Administrators began reporting network authentication failures on October 14, a day after Microsoft released KB5127648. The October 13 update targets Windows 11 version 24H2, build 26100.9711. It also covers version 25H2, build 26200.9711, and version 26H2, build 26300.9711. Business devices using WPA2-Enterprise Wi-Fi or wired 802.1X authentication have reportedly lost network access. Some administrators say setting BlockNtlmv1SSO to 0 restores authentication, though the workaround has not been confirmed as a universal fix.
Reports cited by Neowin describe failures on enterprise connections using PEAP. WPA2-Personal connections continue to work, while enterprise Wi-Fi and Ethernet authentication fail. The reports span computers from different manufacturers. They also include systems with Intel and Qualcomm wireless chipsets. Some administrators regained access by removing KB5127648 and restarting; others say the registry change worked.
In a wired 802.1X report posted to Microsoft Q&A on October 14, an administrator said the client displayed an internal error and authentication requests never reached the RADIUS server. Domain computers remained connected but unauthorized, with retries about every 600 seconds. Removing KB5127648 and restarting restored wired connectivity. Reinstalling the update brought the failure back. The administrator said KB5127648 had been installed alongside KB5127690 and KB5127647. A separate Microsoft Q&A discussion reported a similar failure on WPA2-Enterprise Wi-Fi.
Microsoft's published Windows 11 release information lists other KB5127648 fixes. They address apps that use built-in AC-3 decoding and desktop loading on some systems. The release notes do not list failures involving PEAP, 802.1X or enterprise Wi-Fi authentication.
The reported workaround changes a registry value.
BlockNtlmv1SSO is located under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0. Setting its DWORD value to 0 enables Audit mode, rather than enforcing a block on NTLMv1-derived credentials. A value of 1 enables Enforce mode. The setting controls how Windows creates NTLMv1-derived credentials for a signed-in user.
To test the workaround, open Registry Editor as an administrator. Find or create the 32-bit DWORD named BlockNtlmv1SSO, set it to 0, then restart the device and test authentication. Back up the registry first. Administrators should consult their IT team before applying the change across managed devices.
The setting changes how Windows handles NTLMv1-derived credentials, so administrators need to weigh the security implications for their environment. Setting the value to 0 retains the more permissive legacy authentication behavior that Microsoft is phasing out. Microsoft has not announced this registry change as an official fix for KB5127648.
Microsoft's official KB5127648 release information does not currently list the authentication failure among known issues. The update appears to address a previously reported Group Policy failure; the new reports concern enterprise network sign-in. Microsoft Q&A posts describe the same sequence in affected cases: authentication failed after the update was installed, then returned when it was removed.
Microsoft has been tightening how Windows handles NTLMv1-derived credentials. Those credentials can be used in some MS-CHAPv2 single sign-on scenarios for Wi-Fi and Ethernet. VPN connections are also affected by these scenarios. Credential Guard protects supported devices against this legacy cryptography, and Microsoft recommends enabling it where possible. A separate Windows 11 update issue reportedly broke apps using Dolby Digital AC-3, as another update report described.
Administrators reporting the 802.1X problem have described uninstalling KB5127648 or setting BlockNtlmv1SSO to 0 as ways to restore authentication. Microsoft has not announced the registry change as an official fix.
