Windows 11 Update Causes Widespread Domain Trust Issues for Enterprise Systems
A growing number of administrators have reported a critical issue with Microsoft’s recent Windows 11 security update, KB5124008. The update is causing widespread domain trust failures on enterprise systems, preventing users from logging in with valid domain credentials. According to reports, the problem occurs when machines are rebooted after installing the update, resulting in lost secure channel connections between devices and Active Directory.
The issue affects a significant number of organizations, with multiple administrators reporting similar problems on Reddit and Microsoft’s Q&A forums. One administrator reported that 11 out of 256 Windows 11 Enterprise devices experienced domain trust failures, while another reported that every workstation on their network began rejecting valid credentials after the update was installed.
Microsoft has acknowledged the issue and is actively investigating its cause. While a solution has not yet been announced, reports suggest that the problem may be linked to the “Machine Identity Isolation” security feature, which is part of Windows’ Virtualization-Based Security and Credential Guard configuration. This feature isolates machine account credentials used by domain-joined computers to authenticate with Active Directory.
When Machine Identity Isolation is enabled in audit or enforcement mode, it moves the machine account secret into Credential Guard and removes the copy stored in Local Security Authority (LSA). However, this may be causing a mismatch between locally stored credentials and what Active Directory expects, resulting in domain trust failures. Administrators who have investigated the issue report that disabling Machine Identity Isolation or changing its setting to “0” has resolved the problem.
To troubleshoot the issue, administrators can try running a PowerShell command to repair the secure channel connection with Active Directory. This command, `Test-ComputerSecureChannel -Repair -Credential(Get-Credential)`, requires administrator privileges and may need to be run multiple times before resolving the issue.
While disabling Machine Identity Isolation may resolve the problem in some cases, administrators should exercise caution as it could also cause similar issues elsewhere in their environment. Microsoft’s documentation advises against changing this setting from audit or enforcement mode without careful consideration of potential consequences.
In conclusion, administrators are advised to be vigilant and monitor their systems closely for any signs of domain trust failures after installing the KB5124008 update. If affected by this issue, disabling Machine Identity Isolation or running a PowerShell command to repair the secure channel connection may provide temporary relief. However, it’s essential to await further guidance from Microsoft on a permanent solution to prevent similar problems in the future.
Source: Bleeping Computer — 2026-09-16