Microsoft’s recent security update for Windows 11 has introduced significant issues with Active Directory domain logins. The update, released on September 16, 2026, impacted versions 24H2, 25H2, and 26H1 of Windows 11 due to changes made to Machine Identity Isolation in update KB5124008.
The primary issue is that machine accounts protected by Credential Guard may lose their secure channel connection to on-premises Active Directory. Consequently, users trying to log in with valid domain credentials may receive error messages concerning a failed trust relationship between their device and the domain.
Although the update activates Machine Identity Isolation, enforcement is not automatically applied, leading to complications in non-compliant setups. Devices that do not connect to Windows Server 2025 domain controllers potentially cannot utilize this feature, and Microsoft advises those affected to disable it. Despite this functionality offering enhancements in security by protecting machine account secrets through Credential Guard, its implementation has proven to be less than smooth.
To mitigate the situation, Microsoft has provided a workaround that requires administrators to disable Machine Identity Isolation. This process involves either Intune, Group Policy, or editing the Windows Registry—a task Microsoft cautions should be approached with care. Administrators must ensure they back up the registry before proceeding, as failure to do so may result in difficulty restoring previous settings.
After making the necessary adjustments, admins need to restart the device and repair the secure channel via the PowerShell command Test-ComputerSecureChannel. Looking ahead, Microsoft has indicated plans to address these issues in future updates, including temporarily suspending Machine Identity Isolation enforcement while making necessary improvements.
This situation is yet another indication of the complications arising from recent updates by Microsoft, highlighting the challenges faced by users and administrators in managing system security while adapting to new features.