Windows Domain Login Issues Widespread After Latest Security Updates
A major issue has emerged for Windows 11 users who installed the latest security updates in September. Many are finding themselves unable to log in with valid domain credentials, leading to frustration and disruption for organizations worldwide.
The problem stems from a security mechanism called Machine Identity Isolation, which is being set to enforcement mode after installing update KB5124008 (Windows 11 24H2/25H2) or KB5124012 (Windows 11 26H1). While intended to enhance security, this change causes domain trust failures and sign-in issues with valid credentials. Admins have linked the issue to this specific mechanism, which is not supported in environments running older versions of Windows Server.
Microsoft has acknowledged the problem, confirming that authentication issues are triggered by the September updates. In a release health dashboard update, the company explained that while the update doesn’t directly enable Machine Identity Isolation enforcement, it does cause Windows to honor existing or policy-provisioned settings that enabled this feature. However, Microsoft warns that this feature should only be used in environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above.
As a result of these issues, administrators must disable Machine Identity Isolation on all devices previously configured to use it and not connected to Windows Server 2025 domain controllers. A workaround is available, which involves disabling the feature using management methods such as Intune or group policy. For those who enabled Machine Identity Isolation directly in the registry, Microsoft provides specific steps to disable it.
Meanwhile, Microsoft has released out-of-band Windows updates to address other problems introduced by this month’s security updates, including Remote Desktop Services failures and Hyper-V issues. However, these emergency updates have not resolved all audio-related problems caused by the September 2026 updates.
In light of these issues, organizations relying on Windows domain authentication should prioritize implementing a temporary fix by disabling Machine Identity Isolation on affected devices. This will enable users to log in with valid credentials until Microsoft resolves the issue in an upcoming update.
Source: Bleeping Computer — 2026-09-17