Microsoft’s September Windows 11 Update Breaks Domain Logins Where Machine Identity Isolation Is Enabled

Microsoft has confirmed that its September 2026 security updates can break Active Directory domain logins on some Windows 11 PCs, leaving users unable to sign in with valid credentials. The issue affects Windows 11 versions 24H2, 25H2 and 26H1 and was added to Microsoft’s known issues list on Sept. 16, The Register reported.

What’s going wrong

The cause is a change to Machine Identity Isolation in the September updates (KB5124008 for 24H2/25H2 and KB5124012 for 26H1). Credential Guard-protected machine accounts can lose their secure channel with an on-premises domain, so users may get errors about the trust relationship between the device and the domain even though their username and password are correct. Admins first reported the failures on Microsoft’s Q&A forums and Reddit, BleepingComputer reported.

“While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement,” Microsoft said. “However, this feature is only supported for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above. The feature should be disabled elsewhere.”

“Any devices previously configured to use Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers will experience this issue and will need to disable the feature,” the company added. “Offline sign-in using previously cached credentials might continue to work.” AD replication and AD services on domain controllers aren’t affected.

The workaround

Admins have to disable Machine Identity Isolation using the same method that enabled it: Intune if it came from an Intune policy, Group Policy if it came from Group Policy, or the registry if it was set there. Microsoft advises backing up the registry before making changes. After disabling it, restart the device and repair the secure channel with the Test-ComputerSecureChannel PowerShell cmdlet.

Microsoft’s documentation also warns that if you enable Machine Identity Isolation in enforcement mode and then disable it, domain authentication breaks and the device has to be unjoined and rejoined to the domain, so test the change before rolling it across a fleet.

Microsoft said it plans “to resolve this issue in a future Windows update by temporarily preventing Machine Identity Isolation enforcement while improvements are made to the feature.” The issue comes on top of other September update problems. Microsoft already shipped out-of-band fixes for Remote Desktop Services, Hyper-V and USB audio issues.