Microsoft’s September 16, 2026 Windows release-health notice says KB5124008 can cause some Credential Guard-protected Windows 11 machine accounts to lose their secure channel with an on-premises Active Directory domain. The result can be a failed interactive domain sign-in even when previously cached credentials still work offline. Microsoft lists the issue as mitigated and has documented a recovery path.
KB5124008 was released on September 8, 2026 for Windows 11 versions 24H2 and 25H2. The affected builds are 26100.9445 for 24H2 and 26200.9445 for 25H2.
What administrators may see
The failure affects the trust relationship between a Windows device’s machine account and the Active Directory domain. Users may see a message that the workstation’s trust relationship with the primary domain failed, while an account that has logged on before can still access the computer with cached credentials when it is offline.
The problem is tied to domain authentication, not to every Windows sign-in method. Microsoft identifies Credential Guard-protected machine accounts as the affected configuration. One administrator reported 11 affected Windows 11 25H2 Enterprise devices among approximately 256 devices, but that report does not establish a broader enterprise failure rate.
Microsoft’s release-health information also lists Windows 11 version 26H1 among the client platforms associated with the issue. The KB5124008 support entry identifies the update for versions 24H2 and 25H2.
| Windows version | KB5124008 build | Domain-trust concern |
| Windows 11 24H2 | 26100.9445 | Some Credential Guard-protected machine accounts may lose their Active Directory secure channel. |
| Windows 11 25H2 | 26200.9445 | Some Credential Guard-protected machine accounts may lose their Active Directory secure channel. |
Why Machine Identity Isolation matters
Microsoft says KB5124008 and later updates begin honoring existing or policy-provisioned Machine Identity Isolation enforcement. The update does not directly enable the feature, but it can apply an enforcement setting that was already configured through policy or management tools.
Machine Identity Isolation separates machine-account secrets in a Credential Guard-protected environment. Microsoft says the feature is supported when domain controllers run at Windows Server 2025 Domain Functional Level or later. Earlier administrator reports involved environments with Windows Server 2019 and Windows Server 2022 domain controllers, but those reports do not change Microsoft’s stated compatibility requirement.
The setting has three documented modes:
- 0: disabled
- 1: audit
- 2: enforcement
That distinction matters during recovery. Turning enforcement off is not a harmless switch in every deployment: Microsoft’s technical documentation warns that changing the feature from enforcement to disabled can break domain authentication and may require unjoining and rejoining the device to the domain.
Microsoft’s documented recovery sequence
For the KB5124008-related failure, Microsoft recommends disabling Machine Identity Isolation through the same management channel that enabled it, restarting the device, and repairing the secure channel.
| Step | Action | Important condition |
| 1 | Disable Machine Identity Isolation through Intune, Group Policy, or the registry, depending on how it was configured. | Use the original management method so the policy does not immediately restore the enforcement setting. |
| 2 | Restart the Windows device. | The restart is part of Microsoft’s documented sequence before repairing the channel. |
| 3 | Run Test-ComputerSecureChannel -Repair -Credential (Get-Credential). | The command requires suitable domain credentials and repairs the machine’s secure channel. |
| 4 | If enforcement mode had previously been enabled, handle the domain membership transition. | Microsoft warns that unjoining and rejoining the domain may be required because changing the mode can disrupt authentication. |
Administrators also reported using nltest /sc_query:<domain> and nltest /sc_verify:<domain-controller> to inspect the secure channel. Those checks can help distinguish a domain-trust failure from a broader sign-in problem, but the Microsoft-documented repair command remains the central recovery step for this incident.
The security and domain-membership trade-off
Machine Identity Isolation exists to protect machine-account secrets. Disabling it may restore the authentication path affected by KB5124008, but it also changes the security configuration that isolated those secrets. The domain-membership warning is therefore more than a routine troubleshooting footnote: a rushed registry change can leave administrators with a device that still cannot authenticate to the domain.
If the registry was used to configure the feature, Microsoft identifies these locations:
- HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation
- HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation
When MachineIdentityIsolation is set to 2, Microsoft says it can be changed to 0 in the relevant registry locations. That action belongs inside the documented recovery sequence, alongside the restart and secure-channel repair, rather than as an isolated fix.
What Microsoft’s current status means
Microsoft opened the issue in Windows 11 25H2 release health on September 16, 2026, marked it “Mitigated,” and said a future Windows update would temporarily prevent Machine Identity Isolation enforcement while the feature is improved. The status describes Microsoft’s mitigation and planned remediation; it does not turn the affected configurations into a permanent fix.
Microsoft does not identify KB5129195 as the resolution for the domain-trust issue. The company’s documented path remains focused on the Machine Identity Isolation setting, a restart, and repair of the computer’s secure channel.
