Microsoft is adding phased NTLM signing enforcement in Windows after the latest Patch Tuesday updates. The change comes alongside protections against CVE-2026-118737, a critical severity vulnerability tied to remote code execution on a network through improper verification of a cryptographic signature in Windows Remote Procedure Call Runtime.
NTLM changes in Windows
Microsoft has been phasing out NTLM authentication in Windows in favor of Kerberos-based alternatives over the past few years. The shift applies to both client and server editions of Windows, and IT admins have been urged to prepare for the change. NTLM has not been fully removed, and the latest Patch Tuesday updates improve its security in some respects.
The advisory says the Windows Patch Tuesday updates released yesterday include protections against CVE-2026-118737. Microsoft describes it as a critical severity flaw that allows an attacker to remotely execute code on a network because of improper verification of cryptographic signature in Windows Remote Procedure Call Runtime. To address that threat, Microsoft is improving NTLM message signing in stages.
Phase 1 began on November 10, 2026. In that phase, Windows clients offer NTLM signing on all connections by default, while servers accept both signed and unsigned clients. Audit events record clients that are not using NTLM signing.
Phase 2 is set for May 2027. In that stricter stage, Windows Server will require NTLM signing by default, and clients that do not offer signing will be rejected by secure servers. Microsoft says all supported versions of Windows Server can already perform NTLM signing, and the rollout is a staggered enforcement.
Microsoft’s technical notes
Microsoft points to more technical details that explain the audit events IT admins should monitor, the new registry keys and their possible values, and a set of FAQs. The company says guest account connections are exempt because they have “no meaningful privilege,” so enforcing NTLM signing for them would not improve an organization’s cybersecurity posture. Microsoft also says it may remove the Windows registry keys at a future date.
Licensed under CC BY-ND 4.0 International