Windows 11 September Update Can Break Active Directory Trust

Microsoft has acknowledged a Windows 11 issue that can leave some domain-joined PCs unable to maintain their secure trust relationship with an on-premises Active Directory domain. The problem follows the September 8, 2026 security updates, including KB5124008 for Windows 11 versions 24H2 and 25H2, and affects machines using Credential Guard protected machine accounts with Machine Identity Isolation configured.

When the secure channel fails, valid domain credentials can be rejected or Windows can report that the trust relationship between the workstation and the primary domain failed. Cached offline sign-in may still work on a device where cached credentials are available, but that does not restore the machine account’s working relationship with Active Directory.

Machine Identity Isolation is a Credential Guard feature intended to harden Active Directory machine accounts. Microsoft documents that enabling it moves the device’s machine-account credentials into Credential Guard so future machine authentication is routed through the virtualization-based security environment instead of relying on the ordinary LSA copy.

That security boundary also makes failure behavior more consequential. In enforcement mode, the machine-account secret is moved into Credential Guard and removed from LSA. Microsoft’s documentation warns that domain authentication can fail if Credential Guard cannot provide the protected identity after reboot, potentially leaving recovery dependent on a local administrator account.

The failure concerns the client machine’s secure channel to its on-premises domain. It should not be described as Active Directory itself going down, and it does not mean every PC with KB5124008 will lose domain trust. Administrator reports that surfaced before Microsoft’s acknowledgement showed affected Windows 11 25H2 clients in environments using Windows Server 2019 and Windows Server 2022 domain controllers, but those reports did not establish that every configuration using those server versions is vulnerable.

This distinction matters for fleet response. A domain-trust failure can strand users at sign-in and disrupt domain-backed authentication, but the useful question for administrators is whether their Windows 11 clients have the relevant Credential Guard and Machine Identity Isolation configuration—not simply whether September’s cumulative update is installed.

Microsoft already issued out-of-band Windows updates after the September security release caused separate Remote Desktop Services, Hyper-V/Plan9 sharing and USB-audio regressions. Core Tech Tips covered those emergency fixes separately because they have their own documented scope.

The domain-trust issue emerged as a distinct failure path. Microsoft’s mitigation status and Machine Identity Isolation guidance should therefore be treated as the authority for this problem rather than assuming that installing the earlier emergency package automatically repairs every September regression.