Microsoft’s recent updates have stirred a wave of concerns, particularly regarding Active Directory domain logins. As of September 16, the company acknowledged a significant issue affecting Windows 11 versions 24H2, 25H2, and 26H1, which has been added to their growing list of known problems.
The root of the issue lies in the changes made to Machine Identity Isolation as part of the September 2026 security update (KB5124008). This update has led to complications where Credential Guard-protected machine accounts may lose their secure channel with an on-premises Active Directory domain. Consequently, users may find themselves unable to sign in with valid domain credentials, often encountering messages regarding a broken trust relationship between their device and the domain.
Understanding the Update’s Impact
The update activates Machine Identity Isolation but does not enforce it immediately. Instead, Windows begins to adhere to existing or policy-configured enforcement settings. This presents a challenge, as the feature is only compatible with environments linked to domain controllers operating at the Windows Server 2025 Domain Functional Level (DFL) or higher.
Microsoft has noted, “Any devices previously configured to use Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers will experience this issue and will need to disable the feature.” However, offline sign-in using previously cached credentials may still function as expected. It’s important to note that Active Directory replication and services on the domain controllers remain unaffected.
Workaround and Future Resolutions
In response to the situation, Microsoft has outlined a workaround that requires more than a simple setting change. Administrators must disable Machine Identity Isolation through the same channels used for its activation: Intune, Group Policy, or the Windows Registry. Microsoft has cautioned administrators to back up the registry and ensure they are familiar with restoration processes before proceeding with any modifications.
Once the feature is disabled, administrators are required to restart the device and repair its secure channel using the Test-ComputerSecureChannel PowerShell command.
Looking ahead, Microsoft has indicated plans to address this issue in a forthcoming Windows update by temporarily halting Machine Identity Isolation enforcement while enhancements to the feature are implemented. Despite the complications, the feature itself serves a valuable purpose, allowing machine account secrets to be safeguarded by Credential Guard rather than being stored in the registry. However, the implementation has proven to be less than straightforward, highlighting the complexities involved in managing security updates.
