Windows 11 KB5124008 update breaks domain trust for some users
Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.
Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.
- MachineIdentityIsolation registry value was set to '2' (enforcement mode) after installing KB5124008
- Kerberos failures followed by NTLM and Netlogon fallbacks were observed on affected systems
- Cached credentials still worked offline, confirming a domain authentication issue rather than password problems
- Uninstalling the update and repairing the domain relationship restores access, but reinstalling re-triggers the failure
- Tags
- active-directorycredential-guarddomain-trustkb5124008machine-identity-isolationmicrosoftpatch-managementwindows-11
- Vendors
- Microsoft
From the original article
3 min read at bleepingcomputer.com
Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.