KB5127648 broke 802.1X Wi-Fi and VPN sign-in: find every affected PC in a minute, then fix it for good

Ashish Agarwal — Thu, 29 Oct 2026 11:47:54 +0000

Since the 13 October 2026 cumulative update (KB5127648 on Windows 11, KB5126646 on Windows Server 2025), a lot of office PCs stopped joining WPA2/WPA3-Enterprise Wi-Fi, wired 802.1X and VPN automatically. Typing the password by hand still works. One Microsoft Q&A thread has 400+ people clicking "same question".

What changed

Microsoft is hardening NTLMv1 (message center post MC1508562). From the October update, if this registry value is not set:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0  BlockNtlmv1SSO

Windows treats it as Enforce (1) instead of Audit (0) and blocks NTLMv1-derived single sign-on credentials. PEAP with EAP-MSCHAPv2, signing in with the Windows logon, is exactly that, so those profiles fail.

Not affected:

devices with Credential Guard running;
certificate-based profiles (EAP-TLS, PEAP-TLS);
PSK networks;
users who type their credentials.

That's why only some PCs and some networks break.

Find the affected PCs

Look for event 4025 in Applications and Services Logs → Microsoft → Windows → NTLM → Operational. To check many machines at once, I wrote a small read-only PowerShell script. It reads:

whether the update is installed;
BlockNtlmv1SSO;
whether Credential Guard is running;
each Wi-Fi and wired profile's EAP method and whether it uses the Windows logon;
event 4025.

It prints a verdict per profile and can write a CSV per PC:

.\Test-NtlmV1WifiImpact.ps1
.\Test-NtlmV1WifiImpact.ps1 -Csv \\server\share\ntlmv1-$env:COMPUTERNAME.csv

Kind  Profile   Method              UsesWindowsLogon Verdict
Wi-Fi CorpWiFi  PEAP + EAP-MSCHAPv2             True AFFECTED: PEAP-MSCHAPv2 with Windows logon credentials, Enforce mode

Script (MIT, changes nothing): https://github.com/Donrulezz/Test-NtlmV1WifiImpact

Get people back online today

Set the DWORD BlockNtlmv1SSO = 0 under the key above. For many PCs, use Group Policy Preferences (Computer Configuration → Preferences → Windows Settings → Registry) or an Intune script. Reconnect, or restart if it doesn't take effect.

This turns the weaker NTLMv1-derived sign-in back on. Treat it as a bridge and put a date on it. Uninstalling KB5127648 only lasts until the next cumulative update, which carries the same change.

Fix it for good

Move the affected networks to certificate-based sign-in:

Issue device or user certificates (AD CS auto-enrolment, or Intune SCEP/PKCS).
Add EAP-TLS (or PEAP with certificates) to the NPS network policy.
Push the new Wi-Fi, wired or VPN profile to a pilot group.
Roll it out, then remove PEAP-MSCHAPv2.

Or turn on Credential Guard where the hardware supports it. When you're done, remove the stop-gap value so NTLMv1 sign-in stays off.

gpt-4o, gpt-4.1 and whisper-1 are shutting down: how to find every call in your code and n8n workflows

Ashish Agarwal — Thu, 29 Oct 2026 08:15:00 +0000

OpenAI shuts down gpt-4o, gpt-4o-mini and gpt-4.1 (and their dated snapshots) on 14 January 2027. tts-1 and gpt-4o-mini-tts go on 6 January, the old realtime models on 20 January, and whisper-1 and gpt-4o-transcribe on 26 February. Anthropic retires claude-sonnet-4-5-20250929 on 30 November 2026. After the date, calls to a retired model fail.

Searching for "gpt-4o" finds the obvious calls. These are the ones it misses:

Gateway and cloud spellings: openai/gpt-4o (OpenRouter), us.anthropic.claude-sonnet-4-5-20250929-v1:0 (Bedrock), claude-sonnet-4-5@20250929 (Vertex), and fine-tunes like ft:gpt-4o-mini-2024-07-18:org::abc123, which die with their base model.
Dated snapshots: grep for the exact quoted string "gpt-4o" and you miss "gpt-4o-2024-08-06"; grep without quotes and you also hit every gpt-4o-mini and unrelated mention, with no dates attached.
n8n defaults that never appear in the export: n8n writes a node parameter only when it differs from the default. An OpenAI chat-model node left on its default shows no model at all in the workflow JSON. The OpenAI node's audio transcribe operation hardcodes whisper-1 in n8n's own code, so you can't see it or change it in the node at all.
Config and prompts: .env files, YAML, notebooks, and model names inside prompt templates.

A scanner that handles those cases

I put the matching rules and a dated registry (OpenAI, Anthropic, Google, with a source link for every entry) into a small dependency-free Node script:

git clone https://github.com/Donrulezz/ai-model-retirement-scanner
node ai-model-retirement-scanner/cli.js path/to/project

where                                                         model        shutdown                  move to
example/summarize.py (line 8)                                 gpt-4o-mini  2027-01-14 (in 78 days)   gpt-6-luna
example/support-workflow.json (Support replies > Reply model)  gpt-4.1      2027-01-14 (in 78 days)   gpt-6-luna
example/support-workflow.json (Support replies > Transcribe call)  whisper-1    2027-02-26 (in 121 days)  gpt-transcribe or gpt-live-transcribe

3 finding(s) in 2 files, 2 due within 90 days (registry updated 2026-10-28).

For n8n, export everything first (n8n export:workflow --all --output=workflows.json) and scan the file.

Block it in CI

- run: git clone --depth 1 https://github.com/Donrulezz/ai-model-retirement-scanner /tmp/amrs
- run: node /tmp/amrs/cli.js . --fail-within 60

The job fails when anything in the repo shuts down within 60 days, or has already shut down.

Before you switch

The replacements behave differently. For example, gpt-6-luna is a reasoning model: on Chat Completions, tool calls work only with reasoning_effort: none, and temperature / top_p must be removed unless the effort is none. Test your own prompts on the new model before the date, not on it.

Scanner (MIT): https://github.com/Donrulezz/ai-model-retirement-scanner. Issues welcome if a date moves or a model is missing.

DEV Community: Ashish Agarwal