2026年10月的Windows安全更新可能会导致仍在使用已被长期弃用的NTLMv1安全协议的部分客户出现网络中断。该更新中看似微小的变化，对尚未完全摆脱该遗留技术的管理员和企业可能产生重大影响。在2026年10月更新之前，Windows允许使用NTLMv1衍生凭据进行单点登录，并生成警告事件。更新之后，使用NTLMv1衍生凭据的请求将被阻止。
The October 2026 Windows security update may break networking for some customers who are still clinging to long-deprecated NTLMv1 security. A seemingly minor change in the update could have major implications for administrators and enterprises that haven't fully moved away from the legacy technology. Before the October 2026 update, Windows permitted NTLMv1-derived credentials for Single Sign-On and generated warning events. After the update, requests to use NTLMv1-derived credentials are blocked.
这取决于BlockNtlmSSO注册表值。如果该值未被设置，Windows将使用强制模式（1）而非审计模式（0），从而阻止请求，并可能影响Wi-Fi、以太网和VPN身份验证，进而影响连接。该更新不会设置BlockNtlmSSO的值，管理员可以将其设置为0，以临时允许使用NTLMv1衍生的单点登录凭据。然而，Microsoft指出：“使用审计模式会降低强制模式提供的保护，仅应视为有范围的临时安全例外情况。”
It comes down to the BlockNtlmSSO registry value. If it hasn't been set, Windows will now use Enforce mode (1) instead of Audit mode (0), thus blocking requests and potentially impacting Wi-Fi, Ethernet, and VPN authentication, and therefore connections. The update does not set the value of BlockNtlmSSO, and administrators can set it to 0 to temporarily allow NTLMv1-derived Single Sign-On credentials. However, Microsoft noted, "Using Audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception."
需要明确的是，这不是一个错误，而是设计如此。NTLM被加入弃用列表是在2024年，而Microsoft在2025年8月下旬为NTLMv1的使用添加了审计日志。这家Windows巨头从未掩饰其摆脱遗留技术的意愿，曾在2023年表示：“我们的最终目标是完全消除对NTLM的使用需求。”问题在于NTLM的生命周期较长。它首次出现在1993年的Windows NT 3.1中，尽管按现代标准来看它有些不安全，但将其从企业环境中移除一直很棘手。
To be clear, this is not a bug and is by design. The addition of NTLM to the deprecation list occurred in 2024, and Microsoft added audit logs for NTLMv1 usage in late August 2025. The Windows giant has made no secret of its desire to ditch the legacy technology, stating in 2023, "Our end goal is eliminating the need to use NTLM at all." The problem is NTLM's longevity. It appeared in 1993 with Windows NT 3.1, and removing it from enterprise environments has proven tricky, even though it is somewhat insecure by modern standards.
Microsoft已将其从Windows 11 24H2和Windows Server 2025中移除，但在域加入环境中使用基于MS-CHAPv2的连接时，仍可发现一些残留， notably PEAP-MSCHAPv2和EAP-MSCHAPv2。因此，2025年引入了审计模式，以帮助管理员发现该技术仍在何处被使用。
Microsoft removed it from Windows 11 24H2 and Windows Server 2025, but some remnants can still be found, notably when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2, in a domain-joined environment. Hence the introduction of the audit mode in 2025, to help administrators spot where the technology was still being used.
现在是2026年，微软已经采取了下一步行动。如果未启用Credential Guard且BlockNtlmSSO未设置为审核模式（0），则微软将在“完成NTLMv1禁用”的过程中阻止使用源自NTLMv1的凭据。目前尚不清楚BlockNtlmSSO的变通措施（将值设置为审核模式）能持续多久——很可能直到下一个主要Windows版本发布。微软在9月曾表示，“Windows客户端和Windows Server的市场版本将继续支持NTLM。”
It is now 2026, and Microsoft has taken the next step. If Credential Guard is not enabled and BlockNtlmSSO is not set to Audit mode (0), the use of NTLMv1-derived credentials will be blocked as Microsoft works "to finalize the disablement of NTLMv1." There is no indication of how long the BlockNtlmSSO workaround (setting the value to Audit mode) will work - most likely until the next major Windows release. In September, Microsoft said, "In-market versions of Windows client and Windows Server will continue to support NTLM."
但同时也指出，“我们的长期目标是构建一个完全不需要NTLM的Windows平台。”因此，如果之前的信息还不够明确，此次默认强制执行的举措使其无法被忽视。该技术仍存在于操作系统中，但正逐步淘汰，并将在未来的Windows版本中被移除。因此，2026年10月Windows安全更新后出现的网络问题可能表明，迁移计划的进展程度或完整性可能未达到管理员原本的预期。®
However, it also stated, "Our long-term objective is a Windows platform that doesn't need NTLM at all." As such, if the message wasn't already clear, the move to enforce it by default makes it impossible to miss. The technology still exists in the operating system, but it is on its way out and will be removed in a future Windows release. Problems with networking after the October 2026 Windows security update could therefore signal that migration plans are not as far along, or as complete, as administrators might have thought. ®