Security1 publisher2 min readPublished
Microsoft's September updates break domain logins on fleets that had switched on Machine Identity Isolation
KB5124008 and KB5124012 make Windows honour Machine Identity Isolation settings that were already provisioned, and Microsoft's own documentation says turning enforcement off again breaks domain authentication until the device is rejoined.
The Watch · Security desk
What happened
- Microsoft confirmed on Wednesday that the September 2026 security updates cause domain trust failures and block sign-ins on Windows 11 systems where valid domain credentials are entered.
- Users and IT administrators had been reporting the breakage on Microsoft's Q&A forums, Reddit and other platforms, describing domain trust and credential errors on enterprise machines.
- Microsoft published a temporary fix the same day for the login failures, which affect systems that already had the feature configured before this month's patches went on.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The machines failing are ones nobody touched in September: the policy was provisioned earlier by group policy, Intune or a registry edit, and the update only started honouring it.
- decision Each affected fleet now picks between locked-out users and a disable step its vendor's own documentation describes as breaking domain authentication.
- constraint Ring-based patch staging only surfaces this if the pilot group contains devices carrying the enforcement value; the broad ring is a separate question.
- cost The work lands on the help desk and on whoever walks each device through a reboot and a secure channel repair, with a domain rejoin for the ones that do not come back.
Microsoft's release health note describes the update as changing which settings Windows obeys. "While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement," the company said [5]. Administrators who investigated the sign-in failures describe the same result from the other end, reporting the feature in enforcement mode once KB5124008 or KB5124012 is installed [3].
This is an availability failure produced by a patch [1], and no attacker appears anywhere in the record.
Provisioning ran ahead of support. "However, this feature is only supported for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above. The feature should be disabled elsewhere," Microsoft said [6]. Per Microsoft, admins have to disable the feature on every device previously configured to use it that is not connected to a Windows Server 2025 domain controller [7].
Admins can check for exposure before they install anything. Look for MachineIdentityIsolation set to 2 under the Lsa key or the DeviceGuard policy key, or for the group policy or Intune profile that set it [9][8].
Microsoft's documentation warns that enabling Machine Identity Isolation in enforcement mode and then disabling it will break domain authentication and require the device to be unjoined and rejoined to the domain [4]. Wednesday's workaround disables it anyway: use whichever management channel enabled it, or, where the registry carried the value, set MachineIdentityIsolation to 0, restart the device, and run 'Test-ComputerSecureChannel -Repair -Credential (Get-Credential)' [8][9]. Microsoft did not say whether that repair spares the machine the unjoin and rejoin described in its own documentation.
Microsoft says it is working to resolve the issue by temporarily preventing Machine Identity Isolation enforcement in a future Windows update [10]. Monday's out-of-band releases covered Remote Desktop Services failures, Hyper-V issues and USB audio, and the company says some audio problems are still unresolved [11]. Counting domain sign-in, that is four distinct fault classes from one Patch Tuesday [1].
What to watch
- The future Windows update Microsoft says will temporarily prevent Machine Identity Isolation enforcement, and whether it also repairs machines already stuck.
- Any Microsoft clarification on whether the secure channel repair replaces the documented unjoin and rejoin. The answer decides how expensive the workaround is per device.
- Whether the remaining USB audio problems from the September updates get a second out-of-band release.