Microsoft confirms that the KB5124008 update can break Windows 11 domain trust

Which devices may be affected

The table summarises the conditions described by Microsoft. Matching one of these points does not on its own confirm that a device is affected: the installed build and the specific configuration of each domain must be checked.

Microsoft has also linked the behaviour to certain newer client configurations, including Windows 11 26H1. Check the official documentation that applies to each build before acting.

What the Windows 11 KB5124008 update is

KB5124008 is the cumulative security update released by Microsoft on 8 September 2026 for Windows 11 24H2 and 25H2. It moves devices to builds 26100.9445 (24H2) and 26200.9445 (25H2), and is part of the regular monthly patch cycle.

Days after its release, Microsoft added a known issue affecting devices protected by Credential Guard with Machine Identity Isolation settings. It remains a security update: the advice is not to avoid it, but to check the security configuration of the estate before and after applying it.

What KB5124008 breaks in Active Directory

In an Active Directory domain, every joined device has its own machine account with a password that the system rotates automatically. That credential underpins the secure channel between the device and the domain controller, and it is what later allows user sign-in to be validated, group policies to be applied and shared resources to be accessed.

When the machine account secrets no longer match what Active Directory expects, the secure channel fails. Credential Guard isolates those secrets in a protected environment, and Machine Identity Isolation strengthens that isolation. If the protection starts being enforced in a scenario that does not meet the expected requirements, the device may lose the ability to prove its identity to the domain.

That is why the symptom should not be read as a simple user password error: what fails is the trust relationship between the device and the domain. Resetting the password of the person who cannot sign in solves nothing, because the problem lies in the device's own account.

Symptoms that may appear on affected devices

Signs usually appear after installing the update and restarting the device. These are the most common behaviours reported by administrators and documented by Microsoft:

• The message "The trust relationship between this workstation and the primary domain failed".
• Users unable to sign in with valid domain credentials.
• Access to Windows only through previously cached credentials.
• Inability to reach domain folders and shared resources.
• Logon script failures.
• Problems applying group policies.
• Errors in applications that rely on Active Directory authentication.
• Devices that appear to work normally offline but fail to authenticate against the domain.
• The need to re-establish the device's secure channel with the domain controller.

What Machine Identity Isolation is

Machine Identity Isolation is a Windows security feature that protects the secrets tied to the machine account within a Credential Guard environment. Its purpose is to make it harder for an attacker with access to a device to reuse that machine identity inside the domain.

Microsoft describes three configuration modes: 0 (disabled), 1 (audit) and 2 (enforcement). Moving from audit to enforcement is precisely the critical point, because it changes how the system actually handles device identity.

The feature has compatibility requirements tied to the domain functional level and the domain controllers: Microsoft associates it with environments at Windows Server 2025 domain functional level or higher. In domains that do not meet that requirement, enforcing it can lead to the authentication failures described.

This does not make Machine Identity Isolation a feature to disable across the board. It is a legitimate security control: the right decision is to align its configuration with the real capability of the domain, not to give up the protection by default.

How to recover an affected device

The procedure documented by Microsoft is a temporary mitigation while a permanent fix is prepared. It should be carried out with judgement and documented step by step, especially in companies with large estates:

1. 1.Confirm the device is genuinely affected and not facing another network, DNS or profile issue.
2. 2.Confirm the Windows version and build and whether KB5124008 is installed.
3. 3.Check whether Credential Guard is enabled on the device.
4. 4.Review how Machine Identity Isolation was configured: Intune, group policy, registry or the relevant management tool.
5. 5.Disable enforcement of the policy using exactly the same channel that enabled it.
6. 6.Restart the device.
7. 7.Repair the domain secure channel with appropriate credentials.
8. 8.Validate sign-in, group policy application and access to shared resources.
9. 9.Re-assess the security configuration and plan its reactivation once the environment meets the requirements.

Diagnostic and repair commands

Microsoft documents repairing the secure channel with PowerShell, run with local administrator privileges and domain credentials that have sufficient permissions: Test-ComputerSecureChannel -Repair -Credential (Get-Credential).

For prior diagnosis, the nltest utilities can be used, entering the real domain or domain controller name instead of a sample value: nltest /sc_query:DOMAIN and nltest /sc_verify:DOMAIN. None of these commands should be run automatically across the estate without first understanding the state of each device.

Important warning: do not disable Credential Guard or Machine Identity Isolation, and do not edit the registry, without first checking how the policy was applied and what impact the change may have on authentication and domain membership.

Why a quick registry edit is a bad idea

The setting may appear in registry locations such as HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation. The problem is that the registry may not be the original source of the configuration: if the value is applied by group policy or Intune, it will be written again on the next cycle and the manual change will be temporary.

Changing a security setting without understanding its origin can have real consequences:

• Breaking authentication on devices that were working until then.
• Keeping the problem after a restart, because the policy is re-applied.
• Forcing the device to be removed from the domain and re-joined, with the time loss that entails.
• Weakening the protection of machine account secrets.
• Turning an isolated incident into a widespread one in companies with large estates.

The procedure Seintec applied

In managed environments, the review was carried out in an orderly, documented way, with no mass changes and no improvised uninstalls of security updates. This is the path followed, adapted in each case to the specific configuration of each domain:

• Inventory of Windows versions and builds across the managed estate.
• Identification of devices with KB5124008 installed.
• Review of Credential Guard status.
• Review of the Machine Identity Isolation configuration and its mode.
• Verification of the group policies applied.
• Review of Intune where the environment uses it.
• Secure channel tests against the domain controller.
• Validation of domain user sign-in.
• Verification of access to shared resources and dependent applications.
• Review of security and authentication events.
• Documentation of the changes applied on each device.
• Follow-up monitoring over the following days.

What companies should do now

If your estate includes Windows 11 devices joined to an on-premises domain, this is a sensible plan to close the risk without creating a larger incident:

1. 1.Inventory the Windows 11 devices in the estate.
2. 2.Identify which ones are joined to the Active Directory domain.
3. 3.Check which of them have KB5124008 installed.
4. 4.Verify the builds installed on each device.
5. 5.Check whether Credential Guard is enabled.
6. 6.Analyse the Machine Identity Isolation configuration and mode.
7. 7.Review group policies and Intune to locate the source of the setting.
8. 8.Review trust and authentication errors logged on devices and domain controllers.
9. 9.Check the secure channel state on suspect devices.
10. 10.Take a backup and document any change before applying it.
11. 11.Apply the remediation indicated by Microsoft on affected devices.
12. 12.Validate sign-in and resource access with real users.
13. 13.Record every device that had to be re-joined to the domain.

Impact on companies running Active Directory

A domain trust failure is not a cosmetic problem: it stops users working from the first minute of the day. These are the most common effects in a mid-sized company:

• Users unable to sign in when they arrive at the office.
• Work stoppages at specific desks or across whole departments.
• Loss of access to shared folders and common documentation.
• Failures in ERP applications that authenticate against the domain.
• Problems with network printers published in the domain.
• Access issues on file servers.
• Security policies that stop applying correctly.
• A rise in calls to internal support.
• The risk of applying urgent changes without control or documentation.
• Sound patch management includes inventory, pilot-group testing, backups, documentation, monitoring and a rollback plan defined before touching production.

How Seintec can help with Active Directory and Windows

Seintec manages Windows infrastructure for companies with on-premises, cloud or hybrid environments. In incidents like this, the value lies in having a team that already knows the prior configuration and can act without improvising.

• Active Directory administration and Windows domain management.
• Windows 11 and Windows Server support.
• Professional patch management with maintenance windows, testing and rollback plans.
• Credential Guard, security policies and group policies.
• Microsoft Intune management.
• Domain controller migration and maintenance.
• Resolution of trust relationship and secure channel errors.
• Server and device monitoring.
• Managed IT maintenance and IT support for SMEs and mid-sized companies.
• Cybersecurity, backup and recovery.
• Remote desktop and virtual desktops.
• Specialist technical team, our own datacentre in Spain and a single technical point of contact.

Sources and documentation consulted

Microsoft's official documentation is the primary technical reference and may be updated with new guidance. The information was consulted on 18 September 2026.

• Microsoft: Windows 11 24H2 release health and known issues
• Microsoft: Windows 11 25H2 release health and known issues
• Microsoft Learn: Credential Guard documentation
• Microsoft Learn: Test-ComputerSecureChannel, secure channel repair
• Microsoft Q&A: Technical report and reproduction of the secure channel failure
• BleepingComputer: Coverage of the domain trust issue
• NeoTeo: Context on Microsoft's confirmation

Frequently Asked Questions

What is KB5124008?

It is a Windows 11 security update, released on 8 September 2026 for versions 24H2 and 25H2, that can affect certain devices protected by Credential Guard with Machine Identity Isolation settings.

Does KB5124008 affect every Windows 11 device?

No. Impact depends on the installed build, the device security configuration, whether Credential Guard is enabled, the policies applied and the relationship with an on-premises Active Directory domain.

What does a broken trust relationship mean?

It means the device can no longer correctly establish the secure channel with the domain controller to validate its machine account, so user authentication against the domain stops working.

Can I fix it by changing a registry key?

Not on impulse. You first need to identify how Machine Identity Isolation was configured and apply the recovery through the original management channel, since group policy or Intune can re-apply the previous value.

Which command can repair the secure channel?

Microsoft documents the use of Test-ComputerSecureChannel -Repair -Credential (Get-Credential). It must be run with appropriate domain credentials and after checking the real state of the device.

Will I have to re-join the device to the domain?

In some cases it may be necessary, particularly when a Machine Identity Isolation setting that was in enforcement mode is changed and repairing the secure channel is not enough.

Can Seintec review these problems?

Yes. Seintec can review Active Directory, Credential Guard, group policies, Intune, secure channels, domain controllers and Windows 11 devices, and apply a controlled, documented recovery.