A security update released in September 2026 has introduced a problem for Windows 11 devices that are joined to an Active Directory domain. The update, identified as KB5124008, modifies a feature called Machine Identity Isolation, which is designed to protect machine account secrets using Credential Guard. After the change, some domain-joined PCs are unable to authenticate with valid domain credentials, and users may encounter a message indicating a broken trust relationship between the device and the domain.

The issue affects Windows 11 builds 24H2, 25H2 and 26H1. It arises when the feature is enabled but the domain controller hosting the Active Directory domain is not running Windows Server 2025 or a later version, which is the minimum platform required for the feature to function correctly. Microsoft notes that the update does not automatically enforce the new settings; instead, it begins to honor existing or policy‑configured enforcement configurations, which can cause the trust relationship to fail on systems that do not meet the server version requirement.

Microsoft’s guidance states that any device previously configured to use Machine Identity Isolation and not connected to a Windows Server 2025 domain controller will experience this issue and must have the feature disabled. The recommended remediation involves disabling Machine Identity Isolation through the same management channel used to enable it — such as Intune, Group Policy, or direct registry edits. Administrators are advised to back up the registry and understand the restoration process before proceeding. After disabling the feature, a device restart and a repair of the secure channel using the Test-ComputerSecureChannel PowerShell cmdlet are required.

In the longer term, Microsoft says it plans to address the problem in a future Windows update by temporarily suspending Machine Identity Isolation enforcement while improvements are made to the feature. The company emphasizes that the feature serves a legitimate purpose: protecting machine account secrets when Credential Guard is in use, but its implementation has proven more complex than anticipated. This incident is part of a series of problems identified in the September 2026 update, which has also prompted out‑of‑band patches for related issues.