Upcoming Changes To Ntlmv1 In Windows 11 Version 24h2 And Windows Server 2025

This article details the recent and upcoming changes in Windows 11, version 24H2 and Windows Server 2025, focusing on the auditing and eventual enforcement of blocking NTLMv1-derived cryptography. These changes are part of Microsoft’s broader initiative to phase out NTLM.

Microsoft has removed the NTLMv1 protocol (see Removed features and functionality ) from Windows 11, version 24H2 and Windows Server 2025 and later versions. However, while the NTLMv1 protocol is removed, remnants of NTLMv1 cryptography are still present in some scenarios, such as when using MS-CHAPv2 in a domain-joined environment.

Credential Guard provides complete protection of both NTLMv1 legacy cryptography and many other attack surfaces, and thus Microsoft strongly recommends its deployment and enablement if Credential Guard’s requirements are met. The upcoming changes only affect devices where Credential guard is disabled; if Windows Credential Guard is enabled on the device, the changes outlined in this article do not take effect.

With the deprecation of NTLM (see Deprecated features ) and the removal of NTLMv1 protocol, Microsoft is working to finalize the disablement of NTLMv1 by disabling using NTLMv1-derived credentials.

Two new changes, the introduction of a new registry key and new event logs, are included in this update. For a timeline of these changes, see the Rollout of changes section.

A new registry key is introduced, gating whether the changes are in Audit mode or Enforce mode.

0 (default) - The request to generate NTLMv1-credentials for a logged-on user is audited but allowed to succeed. Warning events are generated. This setting is also called Audit mode.

1 – The request to generate NTLMv1-credentials for a logged-on user is blocked. Error events are generated. This setting is also called Enforce mode.

New auditing capabilities

When using Audit (default) settings Event Log Microsoft-Windows-NTLM/Operational Event Type Warning Event Source NTLM Event ID 4024 Event Text Auditing an attempt to use NTLMv1-derived credentials for Single Sign-On Target server: Supplied user: Supplied domain: PID of client process: Name of client process: LUID of client process: User identity of client process: Domain name of user identity of client process: Mechanism OID: For more information, see https:⁠//go.microsoft.com/fwlink/?linkid=2321802.

When using Audit (default) settings

When using Enforce settings Event Log Microsoft-Windows-NTLM/Operational Event Type Error Event Source NTLM Event ID 4025 Event Text An attempt to use NTLMv1-derived credentials for Single Sign-On was blocked due to policy. Target server: Supplied user: Supplied domain: PID of client process: Name of client process: LUID of client process: User identity of client process: Domain name of user identity of client process: Mechanism OID: For more information, see https:⁠//go.microsoft.com/fwlink/?linkid=2321802.

When using Enforce settings

For more information other auditing enhancements, see Overview of NTLM auditing enhancements in Windows 11, version 24H2 and Windows Server 2025 .

In September 2025 and later updates, the changes will be rolled out to Windows 11, version 24H2 and later client OS in Audit mode. In this mode, Event ID: 4024 will be logged whenever NTLMv1-derived credentials are used but the authentication will continue to work. The rollout will reach Windows Server 2025 later in the year.

In October 2026, Microsoft will set the default value of BlockNTLMv1SSO registry key to 1 ( Enforce ) instead of 0 ( Audit ) if the BlockNTLMv1SSO registry key has not been deployed to the device.

Note These dates are tentative and subject to change.

Frequently asked questions (FAQ)

Microsoft uses a gradual rollout method to distribute a release update over a period of time, rather than all at once. This means that users receive the updates at different times, and it might not be immediately available to all users.

NTLMv1-derived credentials are used by certain higher-level protocols for Single Sign-On purposes; examples include Wi-Fi, Ethernet, and VPN deployments using MS-CHAPv2 authentication. Similarly to when Credential Guard is enabled, Single Sign-On flows for these protocols would not work but manually entering credentials will continue to work even in Enforce mode. For more information and best practices, see Considerations and known issues when using Credential Guard ⁠.⁠

The only similarity between this update and Credential Guard is protections around user credentials from NTLMv1-derived cryptography. This update does not provide the wide and robust protection of Credential Guard; Microsoft recommends Credential Guard enablement on all supported platforms.