Microsoft is currently addressing concerns regarding the Windows 11 KB5124008 security update, which has reportedly disrupted Active Directory domain trust on certain enterprise computers. This issue has left some users unable to log in with their valid credentials.
Impact of the Update on Domain Trust
The incident seems to be associated with Machine Identity Isolation, though Microsoft has yet to confirm the exact cause or offer an official solution. Released on September 8, 2026, the KB5124008 update is designed for Windows 11 versions 25H2 and 24H2, upgrading them to builds 26200.9445 and 26100.9445, respectively. While the release notes mention issues with USB audio, Hyper-V Plan9 folder-sharing, and Remote Desktop Services, they do not currently acknowledge domain trust problems.
Reports from Administrators
An administrator managing workstations running Windows 11 25H2 in a domain with two Windows Server 2019 controllers first reported the problem. The administrator found that installing KB5124008 and rebooting disrupted the secure channel, while uninstalling the update and rejoining the domain temporarily resolved the issue. Unfortunately, reinstalling the update caused the problem to recur.
Users affected by this were met with error messages indicating incorrect usernames or passwords during logins, despite using valid credentials. While cached sign-ins worked offline, network authentication remained functional, suggesting that user credentials were not inherently invalid.
Technical Investigation and Mitigation Efforts
Technical tools such as PowerShell’s Test-ComputerSecureChannel returned False, and nltest /sc_query: generated ERROR_NO_TRUST_LSA_SECRET (error 1786). The domain controller logged Security Event 4625, indicating authentication failure for computer accounts with NTLM Logon Type 3. Investigations ruled out DNS discovery, Active Directory replication, and other potential causes before focusing on Machine Identity Isolation.
Machine Identity Isolation, part of Credential Guard, safeguards machine-account secrets through virtualization-based security. In some cases, setting MachineIdentityIsolation to Disabled through Group Policy and resetting registry values helped mitigate the problem.
Recommendations for Enterprises
Administrators have found that resetting machine passwords and using Test-ComputerSecureChannel with the -Repair option, after disabling isolation, restored domain trust in many instances. However, some systems still required removal from and rejoining to the domain. These measures should be viewed as community-provided temporary solutions rather than official fixes from Microsoft.
Organizations are advised to pause widespread deployment, test changes on a subset of devices, maintain local administrator access, and verify recovery before full implementation. The out-of-band update KB5129195 released on September 14 addresses other issues but does not mention domain trust or Machine Identity Isolation specifically.
Until Microsoft provides a definitive solution, enterprises should continue to monitor updates on Microsoft’s KB page and review Machine Identity Isolation configurations across their Windows 11 systems.
