How to Check NTLMv1 Enforce Mode Changes in Windows 11

What changes with the October 13, 2026 update

The short answer to “what does the October 2026 update do to NTLMv1 on Windows 11?” is this. After the October 13, 2026 security update, a PC with Credential Guard disabled and no BlockNtlmv1SSO value moves from Audit mode (0) to Enforce mode (1).

Before the update, Windows uses Audit mode (0) for NTLMv1 Single Sign-On when the BlockNtlmv1SSO registry value is not set. Starting with the October 13, 2026 Windows security update, Windows uses Enforce mode (1) in that same situation. Per KB5066470, Audit mode lets NTLMv1 Single Sign-On keep working and records events when it is used, while Enforce mode blocks it.

Three details decide whether this affects a PC:

• The update does not touch the registry. It does not create or modify the BlockNtlmv1SSO value. A PC with no value before the update still has no value afterward, but the mode Windows applies is now different.
• The default only applies when the value is not set. A value that someone has set on the PC is the thing to look for, because the new default covers only the “not set” case.
• The change applies only where Credential Guard is disabled. Credential Guard is a Windows security feature that isolates sign-in secrets from the rest of the system. If it runs on the PC, the default change does not apply.

That means you cannot read the result from one setting. The update status, the Credential Guard status and the registry value have to be read together.

Before you start

Gather three things before you open anything.

• An administrator account or its credentials. Registry Editor asks for administrator approval when it opens. Reading a value does not change anything, but the approval prompt still appears.
• A Windows 11 PC that receives security updates. The default changes only after the October 13, 2026 security update installs. Before then, Audit mode (0) remains the default when the value is not set.
• A few minutes. Searching the whole registry by value name takes longer than opening a known path.

The exact registry key that holds BlockNtlmv1SSO is not confirmed here.

For that reason, the steps below search for the value by name instead of browsing to a path. A search finds the value wherever it is stored, so you do not need to know the key in advance.

How to check NTLMv1 Enforce mode changes in 🪟 Windows 11

The steps below test the three conditions that decide the mode: the update, Credential Guard and the registry value. Run them in order and write down what you see at each stage. Nothing here changes a setting, so no restart is needed.

1. Press Win+I to open Settings. The Settings⚙️ window opens.
2. Go to Settings › Windows Update🔃 › Update history. The page lists installed updates by date under headings such as Quality Updates.
3. Look for a security update installed on or after October 13, 2026. If none appears, the new default has not reached this PC yet, and you can stop here.
4. Press Win+R, type msinfo32, and press Enter. The System Information window opens.
5. Select System Summary, the first item in the left pane. The right pane lists system details.
6. Scroll the right pane to the row named Virtualization-based security Services Running. If it lists Credential Guard, the feature is running and the default change does not apply. If the row is empty or does not list Credential Guard, the feature is disabled.
7. Press Win+R, type regedit, and press Enter. Registry Editor needs administrator approval, so select Yes on the User Account Control prompt, or enter administrator credentials.
8. Click Computer, the top item in the left pane, so the search🔍 covers the whole registry.
9. Press Ctrl+F. A small Find dialog appears.
10. Type BlockNtlmv1SSO in the Find what field, exactly as written.
11. Under Look at, clear Keys and Data and leave Values ticked. Then tick Match whole string only.
12. Select Find Next. Registry Editor scans the registry. This can take a few minutes, and the window may look idle while it works.
13. Read the result. If Registry Editor stops on a value named BlockNtlmv1SSO, look at its data in the right pane. If a message says the search🔍 is finished and nothing was found, the value is not set on this PC.
14. Press F3 to look for more matches. The value can exist in more than one place, so keep pressing F3 until the search🔍 reports that it has finished.
15. Close Registry Editor. Do not change anything you found while you are only checking.

That’s it. You now have the three facts for this PC: whether the October 13, 2026 update is installed, whether Credential Guard is running, and whether a BlockNtlmv1SSO value exists. Nothing was modified, so there is nothing to undo.

What to do if the search finds nothing

A missing value is a normal result, not an error. It means nobody has set BlockNtlmv1SSO on this PC. In that case the default applies: Audit mode (0) before the October 13, 2026 security update and Enforce mode (1) after it, as long as Credential Guard is disabled.

How to read your results

Combine what you saw in the three checks. Find the row in the table that matches your three results.

The second row is the one that matters for most unmanaged PCs. The registry looks identical before and after the update, but the behavior is different.

Confirm the Credential Guard status with PowerShell

The quickest check is the Credential Guard status in System Information. PowerShell gives the same answer as text you can copy into a script or a support request. This command reads which virtualization-based security (VBS) services are running. VBS is a Windows feature that runs security services apart from the main system. The command only reads data and changes nothing.

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunning

A 1 in the SecurityServicesRunning list means Credential Guard is running. An empty list means it is not. If the command returns an error or nothing at all, rely on the System Information check instead.

Home, Pro and managed PCs

Credential Guard is aimed at Enterprise and Education editions, so Windows 11 Home and Pro PCs normally do not run it. On those PCs, expect the Credential Guard row in System Information to be empty. That makes the October 13, 2026 default change more likely to apply when no value is set.

Check a PC you do not sit at

The same three facts apply to any PC: the update status, the Credential Guard status and the value. The PowerShell command above works in a remote session with the same meaning. For the registry value, repeat the search by name on that PC. A saved list of results per PC keeps you from rechecking the same machines.

Changing the mode on a PC

This article covers checking, not changing. Editing the registry can break sign-in behavior, and an incorrect value is hard to track down afterward. This article does not confirm the key that holds BlockNtlmv1SSO or its value type.

For that reason, do not create the value from memory.

Read the full details in Microsoft’s KB5066470 before you set anything. What the update does and does not do is already clear: it leaves the registry alone and changes only the default when no value exists.

What to do next

Run the check again after each monthly security update, because a PC without the October 13, 2026 update still uses Audit mode (0) when the value is not set. If a PC shows a value you did not expect, find out who set it before you change it. Policy-managed settings often work this way. If you want another example, read controlling desktop background changes in Windows 11.

For other security settings that you can require rather than leave optional, see how to enforce BitLocker encryption types on Windows 11 drives. See also how to enforce BitLocker encryption on removable drives.