Microsoft Shares Workaround for Windows Domain Login Issues

A Patch Tuesday Regression Hits Domain-Joined PCs

Microsoft shared a temporary fix on Wednesday, September 16, 2026, for a known issue that has been preventing some Windows 11 users from logging in with valid domain credentials after installing the September 2026 security updates. The regression traces back to KB5124008, the September 8, 2026 cumulative update for Windows 11 24H2 and 25H2 (OS Builds 26100.9445 and 26200.9445), with the equivalent 26H1 update, KB5124012 (OS Build 28000.2954), implicated as well.

Administrators began reporting the problem on Microsoft Q&A and Reddit within days of the update shipping: domain-joined Windows 11 machines were losing their Active Directory secure channel after a reboot, leaving users locked out even though their domain credentials were correct. Microsoft initially told BleepingComputer only that it was "aware of the reports and investigating," before formally adding the problem to the Windows 11 known-issues list on release health with a documented workaround.

What's Actually Broken

The root cause is Machine Identity Isolation, a Credential Guard capability that protects a computer's Active Directory machine-account secret using virtualization-based security. According to Microsoft, KB5124008 and later updates don't newly enable Machine Identity Isolation enforcement on their own — but they do cause Windows to start honoring any enforcement setting that was already turned on, whether through the registry or through policy (Group Policy or Intune).

That matters because Machine Identity Isolation enforcement is only supported on devices connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) or higher. Any device that had enforcement configured but talks to older domain controllers — administrators reported reproducing it against both Windows Server 2019 and Windows Server 2022 DCs — starts failing machine authentication once the update lands and the device restarts. Microsoft says domain controllers and AD replication themselves are not affected; this is strictly a client-side machine-account problem.

Microsoft's Workaround

For affected devices, Microsoft's guidance is to disable Machine Identity Isolation enforcement through whichever channel originally enabled it, then repair the machine's secure channel:

1. If it was set via Group Policy or Intune, disable the Machine Identity Isolation policy through that same management channel and let it reapply, rather than editing the registry directly on managed devices.

2. If it was set directly in the registry, check one of these two locations:

   • HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation
   • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation

   If the MachineIdentityIsolation value is set to 2 (enforcement), change it to 0 (disabled).

3. Restart the device so the change takes effect.

4. Repair the secure channel by running the following from an elevated PowerShell prompt:

   Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

   Copy

Microsoft's own advisory notes an important caveat: because enforcement mode moves the machine secret into Credential Guard and removes the copy from the normal LSA environment, simply flipping the setting back is not always enough to restore trust — some administrators reported needing to reset the computer account password, and in a handful of cases, fully remove the device from the domain and rejoin it. Disabling Machine Identity Isolation also reduces the virtualization-based protection on that machine's AD credentials, so treat it as a temporary mitigation rather than a permanent configuration change.

Uninstalling KB5124008/KB5124012 entirely is technically possible and has resolved the issue for some admins, but Microsoft and third-party researchers caution against it: the September update carries a large batch of security fixes, and rolling it back removes those protections along with the buggy feature.

Is a Permanent Fix Coming?

Yes, but it hasn't shipped yet. Microsoft says it plans to temporarily prevent Machine Identity Isolation enforcement in a future update while it works through the underlying compatibility problem with domain controllers below the Windows Server 2025 functional level. No specific release date has been given. Until then, the registry/policy workaround above is the supported mitigation.

What IT Admins Should Do Now

1. Check exposure first: if your organization has never explicitly configured Machine Identity Isolation (via registry, GPO, or Intune), you are very unlikely to hit this — the feature isn't enabled by default.
2. Inventory affected devices: confirm whether your domain controllers meet the Windows Server 2025 DFL requirement before re-enabling enforcement anywhere.
3. Pause broad rollout of KB5124008/KB5124012 to devices with enforcement configured until you've validated the workaround in a test group.
4. Preserve local admin or LAPS access on pilot devices in case a secure-channel repair requires local sign-in.
5. Apply the workaround (policy/registry change, reboot, Test-ComputerSecureChannel -Repair) to already-affected machines, and verify recovery with nltest /sc_verify:<domain> before returning them to production.
6. Watch Windows release health for the permanent fix and re-enable Machine Identity Isolation enforcement only on devices connected to Windows Server 2025-level domain controllers once it ships.

References

• BleepingComputer — Microsoft releases workaround for Windows domain login authentication issues
• BleepingComputer — Windows 11 KB5124008 update breaks domain trust for some users
• Microsoft Support — September 8, 2026—KB5124008 (OS Builds 26200.9445 and 26100.9445)
• Microsoft Support — September 8, 2026—KB5124012 (OS Build 28000.2954)
• WinCentral — Microsoft issues fix for Windows 11 KB5124008 domain bug