Windows 11 KB5124008 Update Breaks Active Directory Domain Trust, Blocks Logins

Key Takeaways

• A recent Windows 11 security update, KB5124008, is causing significant issues with Active Directory domain trust.
• Affected systems are unable to authenticate users, displaying “The user name or password is incorrect” despite valid credentials.
• The problem appears linked to the Machine Identity Isolation feature, a Credential Guard capability.
• No official fix or workaround has been released by Microsoft, though community-reported mitigations involve disabling Machine Identity Isolation or rejoining the domain.
• Organizations are advised to halt broad deployment of the update and meticulously test any proposed solutions.

Windows 11 Update Disrupts Active Directory Trust, Preventing Logins

Microsoft is currently investigating widespread reports that its recent Windows 11 security update, KB5124008, is severely impacting Active Directory domain trust on certain enterprise machines. This critical flaw is preventing users from successfully authenticating and logging into their systems, even when supplying correct credentials.

Unconfirmed Root Cause, Community-Driven Mitigations

While Microsoft has yet to officially confirm the underlying cause or provide an approved workaround, evidence suggests a connection to the Machine Identity Isolation feature. The KB5124008 update, a cumulative security package for Windows 11 versions 25H2 and 24H2, was released on September 8, 2026. This update advances builds to 26200.9445 and 26100.9445, respectively. Notably, Microsoft’s official release notes for this update acknowledge issues with USB audio, Hyper-V Plan9 folder-sharing, and Remote Desktop Services, but conspicuously omit any mention of domain-trust failures.

First Reports Detail Authentication Failures

The initial comprehensive report originated from an administrator managing Windows 11 25H2 workstations operating within a domain controlled by two Windows Server 2019 instances. The administrator reproduced the failure on six separate systems, confirming a direct link: installing KB5124008 and restarting the system consistently broke the secure channel. Conversely, uninstalling the update and re-establishing domain membership successfully restored functionality. Reinstalling the problematic update subsequently re-triggered the issue.

Users on affected systems encountered an error message stating, “The user name or password is incorrect” during interactive logons, despite entering valid credentials. Interestingly, cached sign-ins continued to function when the computer was offline, and network authentication could still succeed in some scenarios, suggesting that the user credentials themselves were not inherently invalid.

Diagnostic tools further highlighted the breakdown: PowerShell’s Test-ComputerSecureChannel command returned False, while nltest /sc_query:<domain> yielded ERROR_NO_TRUST_LSA_SECRET, corresponding to error 1786. The domain controller also logged Security Event 4625 for the affected computer accounts, identifiable by the HOST$ format, indicating a Logon Type 3 failure over NTLM. Status 0xC000006D and sub-status 0xC000006A specifically pointed to an authentication failure.

Administrators have systematically eliminated other potential causes, including DNS discovery, Active Directory replication issues, time synchronization problems, account lockouts, duplicate machine SIDs, and general domain controller health, narrowing the focus to the update itself.

Machine Identity Isolation Implicated

Attention has largely shifted to Machine Identity Isolation, a feature of Credential Guard designed to safeguard Active Directory machine-account secrets using virtualization-based security (VBS). Microsoft’s documentation explains that in enforcement mode, this feature moves the machine secret into Credential Guard, removing its copy from the standard Local Security Authority (LSA) environment. If Credential Guard fails to complete machine authentication following a restart, domain authentication can fail, potentially requiring local administrator intervention for recovery.

In the reported environments, the MachineIdentityIsolation registry value, found at HKLMSYSTEMCurrentControlSetControlLsa, was set to 2, signifying enforcement mode. Administrators found that disabling this feature via Group Policy and the Intune security baseline, then forcing the registry value to 0, successfully halted the recurring authentication failures.

Other administrators have reported success by resetting the machine password and executing Test-ComputerSecureChannel with the -Repair option after disabling isolation. However, some affected systems still necessitated complete removal from the domain, a restart, and a full domain rejoin process.

Ongoing Uncertainty and Recommendations

It is crucial to understand that these community-reported solutions are not official, vendor-approved permanent fixes. Disabling Machine Identity Isolation inherently reduces the virtualization-based protection for machine-account credentials. Conversely, uninstalling KB5124008 removes the security patches delivered with the September cumulative update, leaving systems potentially vulnerable.

The September 14 out-of-band update, KB5129195, addresses the documented RDS, Hyper-V Plan9, and multichannel USB audio problems, but its release notes do not mention any fixes related to domain trust or Machine Identity Isolation.

What You Should Do

• Pause Deployment: Organizations should immediately halt the broad deployment of Windows 11 KB5124008 across their enterprise.
• Test Policy Changes: If considering the suggested mitigations, rigorously test any policy changes (e.g., disabling Machine Identity Isolation) on a limited, non-production device group before wider implementation.
• Maintain Local Access: Ensure that local administrator access or LAPS (Local Administrator Password Solution) is preserved on all endpoints to facilitate recovery if issues arise.
• Verify Recovery: After applying any mitigation, verify successful domain trust restoration using tools like nltest before returning endpoints to production.
• Monitor Microsoft Guidance: Continuously monitor Microsoft’s official KB pages and announcements for definitive guidance, official fixes, or workarounds.
• Audit Machine Identity Isolation: Audit the current Machine Identity Isolation settings across your Windows 11 fleet to understand your exposure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.