Windows update intelligence

Domain-joined devices may lose their secure trust relationship

Some Credential Guard protected machine accounts lost their secure channel with on-premises AD domains, blocking interactive sign-in with valid credentials.

ResolvedC3 · Microsoft confirmedMajor impactSnapshot checked 2026-10-25

Does this match your environment?

Windows scope: 24H2 / 25H2
Architecture: Unknown — not universal
App / driver: Active Directory / Credential Guard
Conditions: Credential Guard protected machine accounts in on-premises Active Directory domains; devices without Credential Guard are not stated as affected.

A matching version is only a starting point. This page does not diagnose an individual device.

Evidence & current resolution

Microsoft lists this scope as resolved on 2026-09-22. Resolving update: KB5124010.

Microsoft official evidence

Evidence ID: official-domain-trust-loss
Source groups: 1 · official publication
Evidence basis: Manually reviewed public source; no independent device test

Evidence permalink

Suggest a correction

Recorded timeline

2026-09-08

Originating update released

KB5124008

2026-09-22

Official resolution recorded

KB5124010

2026-10-25

Snapshot reviewed

Added to this curated collection. Earlier acknowledgement time was not independently captured.

Follow official guidance for your environment. We do not provide automatic rollback or security-disable actions.

Could this be what you are seeing?

Checked 2026-10-25

The official symptom list for this issue, so you can compare it with what your domain-joined devices report before reading further.

Interactive sign-in with valid domain credentials failsOfficial

After installing the September 8, 2026, Windows security update (KB5124008) or the September 14, 2026, Windows out-of-band update (KB5129195), some Credential Guard protected machine accounts might lose their secure channel with an on-premises Active Directory domain, and users might then be unable to sign in interactively with valid domain credentials.

Sign-in reports that the trust relationship failedOfficial

Affected users might receive a message stating that the trust relationship between the device and the domain failed.

Offline sign-in may still workOfficial

Offline sign-in using previously cached credentials might continue to work, so a device that still signs in offline is not automatically excluded.

What is not affectedOfficial

AD replication and AD services on the domain controllers are not affected — the failure is at device sign-in, not in the directory itself.

This list mirrors the official symptoms only. It cannot diagnose an individual device, and an absent symptom does not rule the issue out.

Evidence: tracked:lib/catalog.ts#issues.domain-trust-loss · tracked:docs/qa/evidence/ingest-state-2026-10-24.json#kb5124008 · tracked:docs/qa/evidence/review-2026-10-25.md#domain-trust-loss

Which environments the official scope covers

Checked 2026-10-25

What the captured official sources state about who is affected. The last two conditions are the self-check: the issue requires Machine Identity Isolation enforcement to already be enabled, in a domain that is not at Windows Server 2025 functional level.

Windows versions: Windows 11 24H2 and 25H2
Introduced by: KB5124008 (September 2026 security update, released 2026-09-08) or KB5129195 (September 2026 out-of-band update, released 2026-09-14) or later updates
Machine accounts: Credential Guard protected machine accounts
Domain environment: On-premises Active Directory (AD) domains
Required MII condition: Machines where Machine Identity Isolation (MII) enforcement was already enabled or provisioned by policy — the update itself does not turn enforcement on
Required domain level: Domain controllers below Windows Server 2025 Domain Functional Level (DFL); the feature is officially supported only at Windows Server 2025 DFL and above

Both conditions come from the official root-cause text: the update causes Windows to begin honoring existing or policy-provisioned MII enforcement settings, and that feature is only supported for domain controllers at Windows Server 2025 DFL and above. Devices without pre-existing MII enforcement are not described as affected.

Evidence: tracked:lib/catalog.ts#issues.domain-trust-loss · tracked:docs/qa/evidence/ingest-state-2026-10-24.json#kb5124008 · tracked:docs/qa/evidence/review-2026-10-25.md#domain-trust-loss

Official status and fix

Checked 2026-10-25

The cause, the resolution path, and the workarounds Microsoft published for this issue. The workarounds below are a transcription of the official text, not this site's own steps.

Status: Resolved. Microsoft recorded resolution on 2026-09-22.
Root cause: KB5124008 and later updates cause Windows to begin honoring existing or policy-provisioned Machine Identity Isolation enforcement settings. The feature is only supported with domain controllers at Windows Server 2025 DFL and above, and Microsoft states it should be disabled elsewhere.
Official fix: KB5124010 (September 2026 optional preview, released 2026-09-22). It prevents MII enforcement by disabling it completely — regardless of the MII configuration.
Workaround applicability (official): If you have installed an update released September 22, 2026 (KB5124010) or later, you do not need to use a workaround for this issue. The workarounds below apply only if you are using an update released before September 22, 2026 and have this issue.

Workaround #1 — Known Issue Rollback (KIR) Group PolicyOfficial

Transcribed from Microsoft's release-health entry for this issue: "IT administrators can resolve the issue using Known Issue Rollback (KIR) by installing and configuring the special Group Policy listed below." The policy download is named "KB5124008 260915_17123 Known Issue Rollback" (Download for Windows 11, version 24H2, 25H2, and 26H2). "The special Group Policy can be found in Computer Configuration > Administrative Templates > KB5124008 260915_17123 Known Issue Rollback > Windows 11, version 24H2, 25H2. After installing the Group Policy, configure the value for setting KB5124008 260915_17123 Known Issue Rollback to Disabled and restart your device(s) to apply the Group Policy setting." Microsoft documents deployment in "How to use Group Policy to deploy a Known Issue Rollback".

Workaround #2 — Disable Machine Identity Isolation manuallyOfficial

Transcribed from the same entry. Microsoft's warning first: "Important: This section contains information about modifying the registry. Before you modify the registry, back it up and make sure that you know how to restore it if a problem occurs." Then: "To work around this issue, disable Machine Identity Isolation using the same management method that was used to enable it." If Machine Identity Isolation was enabled by Intune policy, disable Machine Identity Isolation with Intune; if it was enabled by group policy, disable Machine Identity Isolation with group policy; if it was enabled directly in the registry — "On the Windows 11, version 26H2 device, locate the following registry paths" — HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation. "For either of these registry keys, if the value for MachineIdentityIsolation = 2, then set MachineIdentityIsolation = 0. After you disable Machine Identity Isolation, restart the device. Then reset the secure channel using the following command: 'Test-ComputerSecureChannel -Repair -Credential (Get-Credential)'"

Both workarounds are transcribed from the Windows 11 release-health known-issues entry for this issue, whose capture is part of this site's evidence chain; the operational wording is kept as published, including the registry warning. This site adds no steps of its own beyond the transcription.

Evidence: tracked:lib/catalog.ts#issues.domain-trust-loss · tracked:docs/qa/evidence/ingest-state-2026-10-24.json#src-ms-release-health · tracked:docs/qa/evidence/ingest-state-2026-10-24.json#kb5124008 · tracked:docs/qa/evidence/review-2026-10-25.md#domain-trust-loss

What is not yet known

Checked 2026-10-25

Questions the captured official sources do not answer. Each stays open until an official source addresses it.

The Intune and group-policy disable pathsUnknown

Workaround #2 says to disable Machine Identity Isolation "using the same management method that was used to enable it", but only the direct-enablement branch carries in-page steps in the captured entry; the Intune and group-policy branches link out to guidance that is not captured here.

Hybrid or Entra ID scenariosUnknown

The official text covers on-premises AD domains. Whether hybrid configurations or Microsoft Entra joined devices are affected is not stated.

What to do next

Checked 2026-10-25

The actions this evidence supports. Nothing here goes beyond the official fix.

If the symptoms and scope match your environmentOfficial

Install KB5124010 (released 2026-09-22) or a later update. The fix prevents MII enforcement regardless of the MII configuration, which is the resolution Microsoft recorded.

If you are triaging devices that cannot sign inOfficial

The official text gives two facts that help during triage: offline sign-in with previously cached credentials might continue to work, and AD replication and domain-controller services are not affected.

If you were looking for steps to disable MIIOfficial

Both official workarounds are transcribed in the status and fix section above; this site adds no steps of its own. If you are already on KB5124010 or a later update, Microsoft states no workaround is needed.