Microsoft: September 2026 Windows updates break domain trust — workaround shared as 24H2 Home/Pro near end of support and Defender false-alert fix ships

Microsoft confirms the September 2026 updates (KB5124008, KB5124012) cause domain trust failures by activating Machine Identity Isolation and shares a workaround, Windows 11 24H2 Home and Pro stop receiving updates on October 13, 2026, and Defender Antivirus…

Microsoft confirmed that its September 2026 security updates — KB5124008 for Windows 11 24H2/25H2 and KB5124012 for 26H1 — cause Windows to honor Machine Identity Isolation enforcement settings, breaking domain trust on systems not connected to Windows Server 2025 domain controllers. The feature is only supported at the Windows Server 2025 domain functional level, and admins report valid credentials failing with domain trust and credential errors. The workaround requires disabling Machine Identity Isolation via the same management method that enabled it (Intune, group policy, or registry) and then resetting the secure channel with Test-ComputerSecureChannel -Repair; a permanent fix is expected in a future Windows update. Microsoft previously shipped out-of-band fixes for Remote Desktop, Hyper-V, and USB audio issues caused by the same updates. Separately, Microsoft confirmed that Windows 11 24H2 Home and Pro editions, along with Windows 10 Enterprise LTSB 2016, reach end of updates on October 13, 2026, after which they stop receiving monthly security and preview updates. Windows 11 24H2 Enterprise and Education editions remain supported until October 2027, and unmanaged Home/Pro devices will automatically upgrade to Windows 11 25H2. Windows Server 2022 also moves from mainstream to extended support on October 13, 2026, running until October 14, 2031. In addition, Microsoft confirmed in a Windows release health dashboard update that a known issue causing erroneous 'Microsoft Defender Antivirus is turned off' notifications is fixed in the Defender Antivirus update (version 4.18.26080.4) released September 17. The bug affected all supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025, and triggered alerts at startup and intermittently even when the antivirus was active and notification settings were disabled. Microsoft had acknowledged the issue in late August after it appeared in the Windows Insider Release Preview channel since at least June.

• September 2026 security updates KB5124008 (Windows 11 24H2/25H2) and KB5124012 (26H1) trigger domain trust failures by causing Windows to honor Machine Identity Isolation enforcement settings
• Machine Identity Isolation is only supported at the Windows Server 2025 domain functional level; systems not connected to Windows Server 2025 domain controllers break domain trust, with valid credentials failing
• Workaround: disable Machine Identity Isolation via the same management method that enabled it (Intune, group policy, or registry) and reset the secure channel with Test-ComputerSecureChannel -Repair; a permanent fix is expected in a future…
• Microsoft previously shipped out-of-band fixes for Remote Desktop, Hyper-V, and USB audio issues caused by the same September 2026 updates
• Windows 11 24H2 Home and Pro editions and Windows 10 Enterprise LTSB 2016 reach end of updates on October 13, 2026, after which they stop receiving monthly security and preview updates
• Windows 11 24H2 Enterprise and Education editions remain supported until October 2027; unmanaged Home/Pro devices will automatically upgrade to Windows 11 25H2
• Windows Server 2022 moves from mainstream to extended support on October 13, 2026, running until October 14, 2031
• Microsoft Defender Antivirus update 4.18.26080.4, released September 17, fixes erroneous 'Defender Antivirus is turned off' alerts that affected all supported Windows client and server versions, including Windows 11 26H1 and Windows Server…