{
  "id": 8030290,
  "title": "Microsoft patch gives domain-joined Windows PCs trust issues",
  "url": "https://urgent.news/2026/09/17/microsoft-patch-gives-domain-joined-windows-pcs-trust-issues",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-17T13:45:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/os-platforms/2026/09/17/microsoft-patch-gives-domain-joined-windows-pcs-trust-issues/5297155"
  },
  "original_language": "en",
  "account": "Microsoft's September software rollout has brought about yet another set of issues with its Active Directory domain logins. The problem, discovered on September 16, impacts Windows 11 versions 24H2, 25H2, and 26H1. It is attributed to alterations in Machine Identity Isolation introduced with the September 2026 security update (KB5124008). The issue lies in Credential Guard-protected machine accounts potentially losing their secure connection with an on-premises Active Directory domain, resulting in users being unable to log in with valid domain credentials and encountering messages about trust relationship problems between the device and domain.\n\nThe September update enables Machine Identity Isolation but does not activate enforcement directly. Instead, Windows starts respecting existing or policy-configured enforcement settings. This becomes problematic because the feature is only supported in environments connected to domain controllers with a Windows Server 2025 Domain Functional Level (DFL) or later. Devices that were previously configured to use Machine Identity Isolation but are not connected to Windows Server 2025 domain controllers will face this issue and must disable the feature, according to Microsoft.\n\nOffline sign-in using cached credentials may still function. Active Directory replication and services on the domain controllers remain unaffected. Microsoft has offered a workaround, which involves disabling Machine Identity Isolation using the same method that was used to enable it: Intune, Group Policy, or the Windows Registry. Administrators are advised to back up the registry and understand how to restore it before making changes. After disabling the feature, a restart of the device and repair of the secure channel using the Test-ComputerSecureChannel PowerShell command is necessary.\n\nMicrosoft has expressed its plans to resolve the issue in a future Windows update by temporarily disabling Machine Identity Isolation enforcement while enhancements to the feature are made. The feature's usefulness lies in the protection of machine account secrets by Credential Guard instead of storing them in the registry. However, its implementation has proven more complex than anticipated. This revelation comes on the heels of Microsoft's out-of-band update to address other problems introduced in the September update.",
  "summary": "Machine Identity Isolation policies can reject valid credentials unless controllers meet the Server 2025 functional level",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 7,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "September's Windows 11 patch needs an emergency patch of its own",
        "url": "https://urgent.news/2026/09/15/septembers-windows-11-patch-needs-an-emergency-patch-of-its-own",
        "published": "2026-09-15T13:33:55.000Z"
      },
      {
        "outlet": "Tom's Guide",
        "title": "Microsoft just patched over 1,000 flaws in Windows, but you might want to wait to update your PC — here's why",
        "url": "https://urgent.news/2026/09/15/microsoft-just-patched-over-1-000-flaws-in-windows-but-you-might-want",
        "published": "2026-09-15T18:33:34.000Z"
      },
      {
        "outlet": "Mashable",
        "title": "Windows 11 emergency update: Microsoft races to fix bugs",
        "url": "https://urgent.news/2026/09/15/windows-11-emergency-update-microsoft-races-to-fix-bugs",
        "published": "2026-09-15T20:35:43.000Z"
      },
      {
        "outlet": "Arabian Post",
        "title": "Microsoft deploys out-of-band Windows repair update",
        "url": "https://urgent.news/2026/09/16/microsoft-deploys-out-of-band-windows-repair-update",
        "published": "2026-09-16T08:06:11.000Z"
      },
      {
        "outlet": "ZDNet",
        "title": "Windows 11 out-of-band update fixes audio glitch and other bugs – grab it now",
        "url": "https://urgent.news/2026/09/16/windows-11-out-of-band-update-fixes-audio-glitch-and-other-bugs-grab",
        "published": "2026-09-16T09:04:02.000Z"
      },
      {
        "outlet": "Tom's Hardware",
        "title": "Retired Microsoft Engineer details the story about the famous leaked FCKGW Windows XP key — copy protection used 10MB of encrypted Microsoft Bob for validation",
        "url": "https://urgent.news/2026/09/17/retired-microsoft-engineer-details-the-story-about-the-famous-leaked",
        "published": "2026-09-17T10:30:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}