Windows 11 KB5124008/KB5124012: Machine Identity Isolation breaks domain trust — Microsoft workaround
Microsoft release health (Windows 11 24H2/25H2/26H1) confirms domain-joined devices can lose their secure trust relationship with Active Directory after September 2026 updates KB5124008 (24H2/25H2) or KB5124012 (26H1). Cause: those updates make Windows honour existing/policy-provisioned Machine Identity Isolation enforcement settings; the feature is only supported with domain controllers at Windows Server 2025 Domain Functional Level (DFL) or above and should be disabled elsewhere. Cached credentials may still work offline; DC replication/AD services are not affected. Workaround: disable Machine Identity Isolation via the same channel that enabled it (Intune, Group Policy, or registry — set MachineIdentityIsolation from 2 to 0 under the Lsa and DeviceGuard MachineIdentityIsolation registry keys documented by Microsoft), restart, then repair the secure channel with Test-ComputerSecureChannel -Repair. Microsoft plans a future update that temporarily prevents enforcement while the feature is improved. Distinct from ms-sept2026-rds-break-20260910. Primary: Microsoft release health; wire: BleepingComputer 17 Sep 2026.
- Product
- Windows 11 (KB5124008 on 24H2/25H2; KB5124012 on 26H1) with Machine Identity Isolation enforcement
- Versions
- Windows 11 24H2 / 25H2 / 26H1 clients with Machine Identity Isolation configured, not joined to Server 2025 DFL+ domains
- Exploited in Australia?
- unknown
- Patch to
- Disable Machine Identity Isolation (Intune/GPO/registry=0) on non-Server-2025-DFL estates; restart; Test-ComputerSecureChannel -Repair; await Microsoft update that blocks premature enforcement
Primary: Microsoft release health — Windows 11 24H2 (Machine Identity Isolation / domain trust) · Vendor: Microsoft Windows release health (24H2 known issue + workaround) · BleepingComputer — Microsoft domain-login workaround (17 Sep 2026); also KB5124008 initial reports 16 Sep