Microsoft is currently investigating reports that its KB5124008 security update for Windows 11 is causing domain trust relationships to break on some enterprise systems. This issue is preventing users from logging in with valid domain credentials.
Administrators have reported on various forums that after installing the KB5124008 update and rebooting, affected computers lose their secure channel with Active Directory. Microsoft confirmed last week that it is aware of these reports and is actively investigating the issue, stating that guidance will be shared as it becomes available.
While Microsoft has not officially confirmed the underlying cause, reports from administrators suggest a link to the Windows Machine Identity Isolation security feature, particularly when it is configured in audit or enforcement mode. In Active Directory environments, domain-joined computers rely on machine account credentials to maintain a secure channel with domain controllers. A mismatch between these locally stored credentials and those expected by Active Directory can lead to a secure channel failure, resulting in domain trust errors or incorrect password messages for valid credentials.
One Windows administrator, Alex Turner, noted that Windows 11 25H2 workstations functioned normally before the KB5124008 update. Following the update and a subsequent reboot, these devices began experiencing domain login failures. Cached credentials continued to work offline, indicating a problem with domain authentication rather than user passwords. Turner's testing consistently reproduced the issue, showing a broken secure channel with Active Directory. Uninstalling KB5124008 and repairing the domain relationship restored access, while reinstalling the update caused the problem to reappear.
Another administrator reported that 11 out of approximately 256 Windows 11 25H2 Enterprise devices lost domain trust after the update, observing numerous Kerberos authentication failures followed by NTLM and Netlogon fallbacks. Similarly, another administrator stated that all Windows 11 25H2 workstations on their network began rejecting valid domain credentials after the updates.
Turner later connected these failures to the "Machine Identity Isolation" setting, which he observed was set to '2' (enforcement mode) after KB5124008 was installed. Another administrator investigating the issue reported similar findings, noting that 'MachineIdentityIsolation' was set to '2' post-update. Disabling this feature reportedly stopped Windows from discarding the machine account LSA secret, even without removing KB5124008.
Machine Identity Isolation is a component of Windows' Virtualization-Based Security and Credential Guard configuration. Its purpose is to isolate machine account credentials used by domain-joined computers for Active Directory authentication. In enforcement mode, Windows moves the machine account secret into Credential Guard and removes the copy from LSA. This setting is controlled by the registry value `[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "MachineIdentityIsolation"`.
Some administrators have temporarily resolved the issue by setting 'MachineIdentityIsolation' to '0', rebooting, and then repairing the machine's secure channel using PowerShell. One administrator, Marcel Zehnder, successfully used the `Test-ComputerSecureChannel -Repair -Credential(Get-Credential)` PowerShell command after disabling the feature.
However, administrators are cautioned about disabling Machine Identity Isolation, as this action can also lead to similar problems. Microsoft's documentation warns that if Machine Identity Isolation was previously enabled in enforcement mode, disabling it will break domain authentication and necessitate unjoining and rejoining the device to the domain. One administrator reported that changing the setting from audit or enforcement mode to disabled caused domain trust failures across their environment, even on systems that had not installed KB5124008.
As of now, Microsoft has not confirmed that Machine Identity Isolation is the definitive root cause of the KB5124008 failures, nor has it published an official workaround.
