Microsoft patch gives domain-joined Windows PCs trust issues
Machine Identity Isolation policies can reject valid credentials unless controllers meet the Server 2025 functional level
Microsoft's September batch of mishaps continued with confirmation that there is an issue with Active Directory domain logins on Windows 11 versions 24H2, 25H2, and 26H1. The problem, discovered on September 16, is tied to changes in Machine Identity Isolation introduced in the September 2026 security update (KB5124008). This alteration may result in Credential Guard-protected machine accounts losing their secure connection to an on-premises Active Directory domain.
Consequently, users may encounter difficulties signing into their devices using valid domain credentials and may receive an error message regarding the trust relationship between the device and the domain. The update activates Machine Identity Isolation without directly enforcing it, as Windows begins to respect existing or policy-configured enforcement settings.
However, this issue arises because the feature is compatible only with environments linked to domain controllers running Windows Server 2025 Domain Functional Level (DFL) or higher. Devices configured to use Machine Identity Isolation that are not linked to Windows Server 2025 domain controllers will be affected by this issue and must disable the feature.
Microsoft advises this process to be carried out via Intune, Group Policy, or the Windows Registry, emphasizing the importance of backing up the registry and comprehending how to restore it before making changes. Once the feature is disabled, administrators must restart the device and restore its secure channel using the Test-ComputerSecureChannel PowerShell command.
Microsoft anticipates addressing this problem in a future Windows update, which will temporarily disable Machine Identity Isolation enforcement while enhancements are implemented to the feature. Although Machine Identity Isolation offers benefits such as safeguarding machine account secrets in Credential Guard instead of the registry, its implementation has proven to be more complex than expected.
This predicament comes following Microsoft's out-of-band update to rectify other issues introduced in the September update.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Microsoft deploys out-of-band Windows repair update thearabianpost.com
- Microsoft will reveal what's next for Windows and Surface next month, Nvidia RTX Spark included techspot.com
- Microsoft deleted a Windows command that decades of scripts still depend on, and it's gone for good xda-developers.com
- Windows 11 out-of-band update fixes audio glitch and other bugs – grab it now zdnet.com
- Microsoft patch gives domain-joined Windows PCs trust issues theregister.com
- Microsoft just patched over 1,000 flaws in Windows, but you might want to wait to update your PC — here's why tomsguide.com
- Windows 11 emergency update: Microsoft races to fix bugs mashable.com
- Retired Microsoft Engineer details the story about the famous leaked FCKGW Windows XP key — copy protection used 10MB of encrypted Microsoft Bob for validation tomshardware.com
