Windows 11 KB5124008 update breaks domain trust for some users - BleepingComputer
Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials. In Windows Active Directory, domain-joined computers use machine account credentials to maintain a secure channel with domain controllers. Microsoft shares workaround for Windows domain login issues Microsoft: September updates break audio on some Windows PCs Microsoft releases emergency Windows updates to fix RDS failures Microsoft: September updates cause RDS failures on Windows Server Microsoft fixes Teams, Outlook launch failures on ARM Windows PCs
Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials.
Administrators report on Reddit and Microsoft's Q&A forums that affected computers lose their secure channel with Active Directory after the Windows 11 update is installed and devices reboot.
Last week, Microsoft confirmed to BleepingComputer that it is aware of the reports and is investigating.
"Microsoft is aware of these reports and is investigating. We will share guidance as it becomes available," Microsoft told BleepingComputer.
While Microsoft has not confirmed the root cause, reports indicate that the failures are linked to the Windows Machine Identity Isolation security feature, especially when it is enabled in audit or enforcement mode.
In Windows Active Directory, domain-joined computers use machine account credentials to maintain a secure channel with domain controllers.
If those locally stored credentials no longer match what Active Directory expects, the secure channel can fail. This can cause users to receive domain trust errors or be told their username or password is incorrect even though their credentials are valid.
Alex Turner, a Windows administrator who reported the issue on Microsoft's Q&A forums, said Windows 11 25H2 workstations worked normally before KB5124008 was installed. However, after installing the update, the devices started having domain login failures after a reboot.
Cached credentials continued to work while the systems were offline, indicating the problem was tied to domain authentication rather than the users' passwords.
The administrator said testing showed the computer's secure channel with Active Directory had broken and that the issue could be reproduced consistently. Uninstalling KB5124008 and repairing the domain relationship restored access, while reinstalling the update caused the failure to return.
Another administrator on Reddit reported that 11 Windows 11 25H2 Enterprise devices out of approximately 256 devices lost domain trust after being updated.
The administrator also found numerous Kerberos authentication failures followed by NTLM and Netlogon fallbacks on affected systems.
Another administrator said every Windows 11 25H2 workstation on their network began rejecting valid domain credentials after installing the updates.
Turner later linked the failures to a Windows security setting called "Machine Identity Isolation," which he said was set to '2', or enforcement mode, after KB5124008 was installed.
Another administrator investigating the issue reported seeing the same behavior, saying 'MachineIdentityIsolation' was set to '2' after the update and that disabling the feature stopped Windows from discarding the machine account LSA secret without requiring KB5124008 to be removed.
The feature is part of Windows' Virtualization-Based Security and Credential Guard configuration and isolates machine account credentials used by domain-joined computers to authenticate with Active Directory.
In enforcement mode, Windows moves the machine account secret into Credential Guard and removes the copy stored in LSA.
The setting can be controlled through the following registry value:
Some administrators have restored affected systems by setting 'MachineIdentityIsolation' to '0', rebooting, and then repairing the machine's secure channel using PowerShell.
One administrator said the following PowerShell command, run as administrator, restored the secure channel after disabling the feature:
"After a reboot, I had to restore the secure channel by 'Test-ComputerSecureChannel -Repair -Credential(Get-Credential)'. Since then, the computer is running without loosing the secure channel anymore," explained Marcel Zehnder.
However, administrators should be careful about disabling Machine Identity Isolation as it could also cause similar problems.
Another administrator warned that changing the setting from audit or enforcement mode to disabled caused domain trust failures across their environment, including on systems that had never installed KB5124008.
Microsoft's documentation also warns that if Machine Identity Isolation was previously enabled in enforcement mode, disabling it will break domain authentication and require the device to be unjoined and rejoined to the domain.
Microsoft has not yet confirmed that Machine Identity Isolation is the root cause of the KB5124008 failures and has not published an official workaround.
BleepingComputer will update the story when Microsoft provides additional information about its investigation.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Microsoft shares workaround for Windows domain login issues
Microsoft: September updates break audio on some Windows PCs
Microsoft releases emergency Windows updates to fix RDS failures
Microsoft: September updates cause RDS failures on Windows Server
Microsoft fixes Teams, Outlook launch failures on ARM Windows PCs