Windows 11's September update is breaking domain trust

Microsoft has confirmed a fresh problem with September's Windows 11 security update, and this one lands squarely on the people who keep corporate networks running. Devices joined to an on-premises Active Directory domain can lose their secure trust relationship with that domain after installing KB5124008, and users who are perfectly entitled to sign in may find themselves shut out instead.

What Microsoft says is happening

Microsoft's release health page for Windows 11 version 25H2 describes the fault in plain terms. After the 8 September 2026 security update, or any later update, some Credential Guard protected machine accounts might lose their secure channel with an on-premises Active Directory domain. Affected users may be told their valid domain credentials are wrong, or see a message stating that the trust relationship between the device and the domain failed. Signing in offline with previously cached credentials may still work, and Microsoft is explicit that Active Directory replication and the AD services running on domain controllers are not affected. The fault sits on the client, not in the directory.

The cause is a feature Microsoft has been shipping more quietly than it would like. KB5124008 and later updates enable Machine Identity Isolation, a Credential Guard capability that is only supported where domain controllers run at Windows Server 2025 Domain Functional Level or above. The update does not switch enforcement on by itself, but it does make Windows start honouring any Machine Identity Isolation setting that already existed or was provisioned by policy. On a network with older domain controllers, that is enough to break the machine account's secure channel.

What administrators should do

Microsoft has marked the issue as mitigated and published a workaround while it prepares a permanent repair. Administrators need to turn Machine Identity Isolation off using whichever method switched it on: Intune policy, group policy, or the registry. For the registry route, the values to check are MachineIdentityIsolation under HKLM\SYSTEM\CurrentControlSet\Control\Lsa and under HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard, and if either is set to 2 it should be set to 0. Restart the device, then reset the secure channel using Test-ComputerSecureChannel -Repair with a credential prompt. Microsoft says it intends to resolve the matter in a future update by temporarily preventing Machine Identity Isolation enforcement while the feature is improved.

The rest of September's repair list

This is not the only job on Microsoft's plate. The out-of-band KB5129195, released on 14 September, carried protections for CVE-2026-62721, a Windows User-Mode Power Service elevation-of-privilege flaw, and resolved Remote Desktop Services instability and a Plan9 host folder sharing fault that kept Linux virtual machines from seeing shared folders. It also repaired USB Audio Class 1.0 devices that failed in 8-channel or 3D audio modes, while Microsoft concedes that other audio symptoms remain unresolved.

Our opinion

This is the sort of Windows bug that never earns a headline and ruins a working week. A desktop that cannot reach its domain is a paperweight, and the people repairing it are the same ones who were told September was a routine security release. The cause makes it worse: a security feature that only works against Windows Server 2025 domain controllers began being honoured on networks that cannot support it yet. Microsoft's guidance is sound, and the workaround is a ten-minute job for anyone comfortable in the registry, but the people affected are rarely the ones who hold that particular key. The real test is the promised permanent fix, and whether it arrives before October's Patch Tuesday stacks another layer on top.