How to Set the BlockNtlmv1SSO Registry Value in Windows 11

What the BlockNtlmv1SSO value does

People often search for the “BlockNtlmv1SSO registry key”, but it is a registry value, not a key. A key is a folder in the registry, and a value is a named setting stored inside it. BlockNtlmv1SSO is a value that lives in the msv1_0 key, and you set it to 0 or 1.

It is a REG_DWORD, a 32-bit number stored in the registry. It has two settings that matter:

• 0 (Audit mode)Windows allows requests that use NTLMv1-derived credentials for Single Sign-On, but it generates warning events so you can see which requests would have been affected.
• 1 (Enforce mode)Windows blocks those requests.

Audit mode is the safe place to start. It shows what depends on NTLMv1 before anything stops working. Move to Enforce mode once you know nothing you need relies on those requests.

The msv1_0 key sits under the Lsa key. Microsoft lists the current location as 🗝️HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\msv1_0copy. The path uses lowercase “currentcontrolset”, exactly as written here.

Before you change the value

You need administrator rights

The value sits under 🗝️HKEY_LOCAL_MACHINEcopy, which holds settings for the whole computer. Only an administrator account can change it. With a standard account, Windows asks for an administrator password when Registry Editor opens. Without one, the value will not save.

Start with Audit mode on a test device

Setting the value to 1 is a security change that can stop an app, network connection or service from signing in. It can be reversed quickly, but the damage may not show straight away. Set 0 first and watch the warning events for a while. Move to 1 only after you have found and dealt with anything that uses NTLMv1-derived credentials.

The same caution applies to other sign-in and encryption changes. If you are also changing startup protection, read how to enable BitLocker with a PIN and USB key in Windows 11 before you stack the changes together.

Back up the key first

A registry backup lets you restore the previous state in seconds. Registry Editor can export the msv1_0 key to a .reg file, which is a small file that writes the saved settings back when you open it. The export step is part of the numbered list below, so you do not have to look for it.

Know your recovery information

Changing this value does not touch BitLocker or your disk encryption. Still, if you are editing security settings on a laptop, confirm that you can reach your recovery key before you start. Use how to find your BitLocker recovery key in Windows 11 if you are unsure where yours is stored.

How to set the BlockNtlmv1SSO registry value

These steps create or edit the BlockNtlmv1SSO registry value in Windows 11 and set it to Audit (0) or Enforce (1). They require an administrator account.

1. Open Registry Editor. Press Win+R, type regedit, and press Enter. This step requires administrator privileges. When User Account Control asks whether to allow the app to make changes, select Yes. If you are not signed in as an administrator, enter an administrator password when prompted. Registry Editor opens with a list of keys in the left pane.
2. Go to the Lsa key’s msv1_0 subkey. Click the address bar at the top of Registry Editor, paste HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\msv1_0, and press Enter. The left pane expands to the msv1_0 key, and its existing values appear in the right pane.
3. Back up the msv1_0 key. Right-click msv1_0 in the left pane, choose Export, name the file (for example, msv1_0-backup), and select Save. To restore it later, double-click that .reg file and confirm the prompt.
4. Look for an existing BlockNtlmv1SSO value. Check the Name column in the right pane. If BlockNtlmv1SSO is listed, skip to step 6. If it is not listed, continue to step 5.
5. Create the BlockNtlmv1SSO value. Right-click an empty area of the right pane, choose New › DWORD (32-bit) Value, and type BlockNtlmv1SSO as the name. Press Enter. Match the spelling and capitalisation exactly, because a misspelled name is ignored. A new entry appears with the type REG_DWORD and a data value of 0.
6. Open the value. Double-click BlockNtlmv1SSO. An Edit DWORD (32-bit) Value window opens with the name at the top and a Value data box.
7. Enter the value data. Type 0 for Audit mode, or 1 for Enforce mode. Leave Base at its default setting. Base controls how the number is shown, and 0 and 1 look the same in Hexadecimal and Decimal.
8. Select OK. The window closes and the right pane shows your number in the Data column next to BlockNtlmv1SSO.
9. Close Registry Editor. Microsoft says no restart is needed after you change this value. Close Registry Editor and the new setting applies.

That’s it. BlockNtlmv1SSO now exists under the msv1_0 key with the mode you chose, and Windows applies it without a restart.

If step 1 shows an error such as “Registry editing has been disabled by your administrator”, a policy on the device blocks Registry Editor. Contact the person who manages the device. If step 8 fails with “Cannot edit BlockNtlmv1SSO: Error writing the value’s new contents”, Registry Editor is running without administrator rights. Close it and repeat step 1.

Choosing between 0 and 1

The two data values change behaviour in different ways. Choose based on how much you know about what signs in to the device.

Use 0 to audit first

With 0, Windows allows the request and records a warning event. Those warnings are your evidence. They show that something on the network or device used NTLMv1-derived credentials for Single Sign-On.

Review them in Event Viewer, the built-in tool for reading Windows event logs. This article does not name the exact log, because the release notes it draws on do not specify one. Microsoft’s documentation lists the log location for your build, so check there before you search the logs.

Leave the device in Audit mode long enough to cover normal use. That means regular sign-ins, reconnecting to the network after sleep, and any VPN or Wi-Fi connections people rely on. A short test can miss a weekly or monthly task.

Use 1 to enforce

With 1, Windows blocks the NTLMv1-derived Single Sign-On requests that Audit mode would only have logged. Set this only after the audit shows nothing you need still depends on those requests. If something did depend on them, fix that dependency first, or move it to a stronger sign-in method.

Test Enforce mode on one device or a small group before you apply it more widely. A single machine shows quickly whether anything breaks, and changing the value back takes a minute.

How to confirm the value is set

Open Registry Editor again and go to 🗝️HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\msv1_0copy. In the right pane, find BlockNtlmv1SSO. The Type column should read REG_DWORD, and the Data column should show 0x00000000 (0) for Audit mode or 0x00000001 (1) for Enforce mode.

If the value is missing after you created it, you probably created it under the wrong key. Check that the left pane has msv1_0 selected, not the parent Lsa key, and repeat step 5.

Why the value may not appear or may not stick

Registry Editor lists only values that exist. A fresh Windows 11 installation may not show BlockNtlmv1SSO at all until you create it, which is why step 5 exists. A missing value does not mean the feature is absent. It means nobody has set it yet.

The KB5066470 release notes describe the value, so a device that has not received that update may not act on it. Install your pending updates through Settings › Windows Update before you spend time troubleshooting.

The checklist below covers the other common reasons a change does not take effect:

• Wrong keyThe value must sit in msv1_0, not in Lsa or another subkey.
• Wrong typeThe value must be a DWORD (32-bit) Value. A String Value with the same name does nothing.
• Wrong spellingA misspelled name is ignored, so compare it letter by letter with BlockNtlmv1SSO.
• Managed deviceIf your organisation manages the computer, a management tool may control this setting. Ask your IT team before you override it by hand.

Registry Editor is included in Windows 11 Home as well as Pro, so you do not need a particular edition for these steps.

How to undo the change

Undoing the change takes less than a minute, and no restart is needed.

1. Open Registry Editor as an administrator. Press Win+R, type regedit, press Enter, and select Yes at the User Account Control prompt. Registry Editor opens.
2. Go to the msv1_0 key. Paste HKEY_LOCAL_MACHINE\SYSTEM\currentcontrolset\control\lsa\msv1_0 into the address bar and press Enter. The right pane shows the values stored in msv1_0.
3. Open BlockNtlmv1SSO. Double-click the value in the right pane. The Edit DWORD (32-bit) Value window opens.
4. Set Value data to 0. Type 0 in the Value data box and select OK. The Data column now shows 0.

That’s it. Windows returns to Audit mode: requests are allowed, and warning events are generated.

To restore the exact state you had before, double-click the .reg file you exported in step 3 of the main procedure and confirm the prompt. If you want to remove the value entirely, right-click BlockNtlmv1SSO and choose Delete. Windows then falls back to its built-in default for that setting. This article cannot confirm the default on your build, so setting 0 by hand is the more predictable choice.

If sign-in breaks after you enforce

If an app or connection stops signing in after you set the value to 1, switch back to 0 using the undo steps above. Because Windows applies the change without a restart, the connection often works again as soon as the value changes. Then check the warning events from Audit mode to identify the request that relied on NTLMv1-derived credentials. Fix it at the source before you enforce again.

If the broken sign-in involves a hardware sign-in method rather than a network resource, that is a separate problem. See how to reset your security key on Windows 11 instead.

What to do next

Leave BlockNtlmv1SSO at 0 for a full working cycle and read the warning events before you move any device to 1. When you are ready to enforce, change one test device first, then confirm that your normal sign-ins still work. If you are tightening other security settings on the same device, adding a PIN or USB key to BitLocker startup is a logical next change.