KB5127648 may break 802.1X PEAP authentication on Windows 11

What changed

On 15 October Microsoft added the Authentication release note: where Credential Guard is disabled and BlockNtlmv1SSO is unset, the internal default changes from Audit (0) to Enforce (1), blocking NTLMv1-derived SSO credentials.

Technical details

• Microsoft documents the authentication hardening in KB5127648 and links KB5066470.
• The documented scope is Credential Guard disabled plus an unset BlockNtlmv1SSO value; it is not a universal PEAP outage.
• No separate corrective update for the community-reported PEAP incident is identified in this release note.

Why it matters

Organizations that depend on PEAP-MSCHAPv2 for corporate Ethernet or Wi-Fi can lose network access immediately after the October security update, preventing normal Intune, Group Policy and remote-remediation paths from reaching affected devices.

Known limitations

• Community error codes and reproduction reports remain supplementary evidence, not independently confirmed Microsoft symptoms.
• An audit-mode exception reduces authentication hardening; use only after security review with a scoped owner, expiry and rollback.

Additional evidence

• Independent technical analysis by Thomas Marcussen ↗
• Microsoft Q&A: wired 802.1X PEAP report ↗

Now check

• Inventory Credential Guard state, BlockNtlmv1SSO configuration and MS-CHAPv2 dependencies before wider rollout.
• Pilot wired, wireless and VPN authentication with representative users; correlate EapHost, AutoConfig, NTLM and RADIUS logs.
• Use KB5066470 to assess mitigation; prioritize certificate-based EAP-TLS and avoid an organization-wide registry exception.