Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins

Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking Active Directory domain trust on some enterprise computers, leaving users unable to sign in with valid credentials.

The problem appears linked to Machine Identity Isolation, although Microsoft has not confirmed the root cause or published an official workaround.

Released on September 8, 2026, KB5124008 is a cumulative security update for Windows 11 versions 25H2 and 24H2, advancing them to builds 26200.9445 and 26100.9445, respectively. Microsoft’s release notes currently document USB audio, Hyper-V Plan9 folder-sharing, and Remote Desktop Services problems, but do not list domain-trust failures among the update’s known issues.

The first detailed report came from an administrator managing Windows 11 25H2 workstations in a domain with two Windows Server 2019 controllers. The administrator reproduced the failure on six systems: installing KB5124008 and restarting broke the secure channel, uninstalling the update and rebuilding domain membership restored it, and reinstalling the update triggered the problem again.

Affected users saw “The user name or password is incorrect” during interactive logon despite supplying valid credentials. Cached sign-in worked while the computer was offline, and network authentication could still succeed, indicating that ordinary user credentials were not necessarily invalid.

PowerShell’s Test-ComputerSecureChannel returned False, while nltest /sc_query:<domain> produced ERROR_NO_TRUST_LSA_SECRET, error 1786.

The domain controller also recorded Security Event 4625 for the computer account, identified by the HOST$ format, with Logon Type 3 over NTLM. Status 0xC000006D and sub-status 0xC000006A indicated an authentication failure.

Administrators said DNS discovery, Active Directory replication, time synchronization, account lockouts, duplicate machine SIDs, and general domain-controller health had been ruled out.

Attention then shifted to Machine Identity Isolation, a Credential Guard capability that protects Active Directory machine-account secrets using virtualization-based security.

Microsoft explains that enforcement mode moves the machine secret into Credential Guard and deletes its copy from the normal Local Security Authority environment. If Credential Guard cannot complete machine authentication after a restart, domain authentication can fail, and recovery may require a local administrator.

In the reported environment, the MachineIdentityIsolation registry value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa was set to 2, representing enforcement mode. Setting the feature to Disabled through Group Policy and the Intune security baseline, then forcing the registry value to 0, stopped the repeated failures.

Other administrators reported restoring trust by resetting the machine password and running Test-ComputerSecureChannel with the -Repair option after disabling isolation. Some affected systems still required removal from the domain, a restart, and a complete domain rejoin.

Administrators should treat this as a community-reported mitigation rather than a vendor-approved permanent fix. Disabling Machine Identity Isolation reduces virtualization-based protection for machine-account credentials, while uninstalling KB5124008 removes the security fixes delivered with September’s cumulative update.

Organizations should consider pausing broad deployment, test policy changes on a limited device group, preserve local administrator or LAPS access, and verify recovery with nltest before returning endpoints to production.

The September 14 out-of-band update KB5129195 fixes documented RDS, Hyper-V Plan9, and multichannel USB audio problems, but its release notes do not mention domain trust or Machine Identity Isolation.

Until definitive guidance arrives, enterprises should monitor Microsoft’s KB page and audit Machine Identity Isolation settings across Windows 11 fleets.