Windows Update Leaves Computers Without Automatic Network Access: It’s Time to Switch to Certificates
The October 2026 Windows security update may prevent laptops and business PCs from automatically connecting to Wi-Fi, wired networks, or VPNs. The issue involves an outdated authentication method that uses the Windows username and password to grant network access—a feature Microsoft is disabling for security reasons. Microsoft’s recommended solution is to switch to digital certificate authentication.
What has changed?
Many companies connect computers to the network using the same credentials that users use to log into Windows. The technical method is called PEAP-MSCHAPv2 and is convenient: the user logs in and stays connected without having to do anything else. However, it relies on legacy NTLM encryption, a technology that Microsoft considers insecure and is gradually phasing out.
The phase-out is occurring in two stages. Starting with Windows 11 22H2, on computers with Enterprise or Education licenses (and on some Pro licenses), Credential Guard is enabled by default and already blocks automatic connection using this method. With the October 13, 2026, update (KB5127648), the block will also apply to all other computers running Windows 11 24H2, 25H2, and 26H2, and Microsoft warns that it may affect Wi-Fi, wired, and VPN connections that use MS-CHAPv2. On Windows Server 2025, the change arrives with KB5126646.
Who is affected, and how will it be noticeable?
This affects organizations with enterprise Wi-Fi (WPA2/WPA3-Enterprise), 802.1X authentication on wired networks, or native Windows VPNs that authenticate Windows users through an NPS or RADIUS server.
After the update, computers will no longer automatically connect to the corporate network. Users will now have to enter their password every time they connect, or they will simply be denied access. There is a temporary workaround to restore functionality, but it reduces Windows security, does not work on devices with Credential Guard, and Microsoft itself presents it only as a temporary solution until migration is complete.
Postponing updates is not an option either: the change is included in the monthly security updates, and failing to install them opens other security vulnerabilities.
The solution? Certificate-based authentication
Microsoft recommends replacing this method with certificate-based authentication, known as EAP-TLS, as described in the Credential Guard documentation. Each computer automatically receives a digital certificate that identifies it on the network, without relying on the user’s password.
The benefits go beyond solving the immediate problem. EAP-TLS is not affected by this change. Authentication no longer relies on passwords, reducing the risk of credentials being intercepted and cracked over the network. And the organization is prepared for passwordless access, using Windows Hello or FIDO2 keys.
Eurotux is conducting the transition to EAP-TLS as a phased project, starting with a pilot group and then expanding to the headquarters or across the network. During the migration, both methods operate in parallel, with this phase planned according to the computers’ update status: the transition is virtually transparent to users, and a fallback plan is always in place.
The work involves creating or adjusting the certificate infrastructure (Active Directory Certificate Services or Microsoft Intune), with automatic issuance to computers, and reconfiguring the NPS or RADIUS server to accept certificates. Wi-Fi, wired network, and VPN profiles are updated centrally. For devices that do not support certificates—such as printers, personal cell phones, or IoT devices—an alternative is defined, such as an isolated network.
Access points and switches remain in place, typically without significant changes, so there is no need to replace network equipment. The scope of each project depends on the number of locations and computers, the devices that do not support certificates, and the existing infrastructure, and is evaluated on a case-by-case basis.
If your organization authenticates computers on the network using Windows credentials, it’s worth evaluating the migration now, before users encounter problems. The Eurotux team can analyze your infrastructure and propose the most appropriate plan.
