KB5124008 is severing Windows 11 machine accounts from their domain controllers

A domain-joined Windows machine stores its own machine account credentials locally and uses them to keep a secure channel open to a domain controller. When the local copy stops matching what Active Directory expects, the channel fails, and the user either gets a domain trust error or is told the password is wrong even though it is valid ^[6]. Machine Identity Isolation is part of the Virtualization-Based Security and Credential Guard configuration and isolates those machine account credentials ^[15]. In enforcement mode, Windows moves the machine account secret into Credential Guard and removes the copy held in LSA ^[16].

The value sits under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa with the name MachineIdentityIsolation ^[17]. One administrator investigating the failures said disabling the feature stopped Windows from discarding the machine account LSA secret, and that KB5124008 did not have to be uninstalled for that to hold ^[14].

The two public scope reports do not agree. A Reddit administrator counted 11 Windows 11 25H2 Enterprise devices out of roughly 256 losing domain trust after the update, about 4.3 percent of that estate ^[10][1]. Another said every Windows 11 25H2 workstation on their network began rejecting valid domain credentials after the updates went on ^[12].

Alex Turner, the Windows administrator who filed the report on Microsoft's Q&A forums, said his 25H2 workstations were normal before KB5124008 and started failing domain logins after a reboot ^[7]. Cached credentials kept working while those systems were offline. That points at domain authentication ^[8].

Some administrators have recovered machines by setting MachineIdentityIsolation to 0, rebooting, and repairing the channel from PowerShell ^[18]. "After a reboot, I had to restore the secure channel by 'Test-ComputerSecureChannel -Repair -Credential(Get-Credential)'. Since then, the computer is running without loosing the secure channel anymore," explained Marcel Zehnder ^[19].

Disabling the feature is its own change with its own failure mode. One administrator reported that moving the setting from audit or enforcement mode to disabled caused domain trust failures across their environment, including on systems that had never installed KB5124008 ^[20]. Microsoft's own documentation warns that if Machine Identity Isolation was previously enabled in enforcement mode, disabling it will break domain trust ^[21].

Microsoft has not confirmed a root cause. The link to Machine Identity Isolation comes from administrator reports ^[5]. "Microsoft is aware of these reports and is investigating. We will share guidance as it becomes available," Microsoft told BleepingComputer last week ^[3][4]. Until that guidance names something, both the enable path and the disable path have produced the same outcome on someone's estate, so the feature is a per-configuration test against a small 25H2 ring ^[13][20].