Microsoft is investigating reports that the KB5124008 security update for Windows 11 disrupts the trust relationship between some domain-joined devices and Active Directory domain controllers. As a result, users fail to sign in with valid credentials after restarting their devices, although cached credentials continue to work when the devices are used offline.
Microsoft confirmed to BleepingComputer last week that it was aware of and investigating the reports, adding that it would share guidance when available. As of September 16, 2026, the company has not confirmed that Machine Identity Isolation is the root cause, nor has it published an official solution to the problem.
How does the problem appear?
Devices joined to Active Directory use computer account credentials to maintain a secure communication channel with domain controllers. If the credentials stored locally no longer match what Active Directory expects, this channel fails, and users may see a message indicating that there is an error with the trust relationship or that the username or password is incorrect.
System administrator Alex Turner said in a Microsoft Questions forum that workstations running Windows 11 25H2 were functioning normally before the update was installed, but began failing to sign in after restarting. He reported that removing KB5124008 and repairing the domain relationship restored access, while reinstalling the update caused the problem to return. Another administrator reported a lost trust relationship on 11 of approximately 256 devices running Windows 11 25H2 Enterprise.
Technical indicators on affected systems included Kerberos authentication failures, followed by a fallback to NTLM and Netlogon. Multiple reports linked the problem to the MachineIdentityIsolation setting when it is in audit or enforcement mode, particularly after it was set to value 2. This feature is associated with Virtualization-Based Security and Credential Guard settings, as it isolates the computer account credentials used for authentication with Active Directory.
What changes in practice for system administrators?
Some administrators reported that setting the option to value 0, then restarting and repairing the secure channel using PowerShell, restored access. The commands mentioned include:
Test-ComputerSecureChannel -Repair -Credential(Get-Credential)
However, these steps are not an official solution, and changing the isolation setting arbitrarily may cause additional failures. Microsoft documentation warns that disabling Machine Identity Isolation after it has been enabled in enforcement mode may break domain authentication and may require removing the device from the domain and joining it again. Another administrator also said that disabling the feature caused failures even on devices that had not installed KB5124008.
Why does this news matter?
The significance of the problem is that it does not concern an individual password failure, but rather the trust mechanism on which enterprise Windows environments rely for centralized authentication. Therefore, a single security update may become a widespread operational obstacle after a restart, particularly in organizations using Windows 11 25H2 and Active Directory with Credential Guard settings. Because Microsoft has not yet established the cause, any broad changes to the registry or security policies should be preceded by limited testing and documentation of device status until official guidance is released.