Microsoft Investigating Windows 11 Update That Breaks Enterprise Domain Trust

Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on enterprise systems. The issue prevents users from logging in with valid domain credentials, particularly on Windows 11 25H2 workstations, after the update has been installed and the system has rebooted.

Administrators reporting the issue noted that affected computers lose their secure channel with Active Directory. While cached credentials allow users to log in while the systems are offline, domain authentication fails once the connection to the network is attempted. Testing has shown that uninstalling the KB5124008 update and repairing the domain relationship restores access, but the failure returns if the update is reinstalled.

Suspected link to Machine Identity Isolation

Although Microsoft has not yet confirmed a root cause, technical reports suggest the failures are linked to a security feature called Machine Identity Isolation. This feature is part of Windows Virtualization-Based Security (VBS) and Credential Guard configurations.

When Machine Identity Isolation is set to enforcement mode, Windows moves the machine account secret into Credential Guard and removes the copy stored in the Local Security Authority (LSA). It appears the KB5124008 update may be triggering this transition in a way that breaks the existing secure channel with the domain controller.

The setting is controlled via the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa under the value MachineIdentityIsolation.

Reported Mitigations and Risks

Some administrators have attempted to restore access by setting the MachineIdentityIsolation value to 0 and then repairing the secure channel using PowerShell. One reported method involves using the command: Test-ComputerSecureChannel -Repair -Credential(Get-Credential).

However, disabling this feature carries risks. Microsoft documentation warns that if Machine Identity Isolation was previously enabled in enforcement mode, disabling it may break domain authentication entirely, potentially requiring the device to be unjoined and rejoined to the domain.

Microsoft has confirmed it is aware of the reports and is currently investigating. No official workaround or patch has been released by the vendor at this time.