Microsoft Shares Workaround for Windows 11 Domain Sign-In Failures After September Updates
Summary
September 2026 Windows 11 security updates caused domain trust and sign-in failures on some systems. Microsoft advises disabling Machine Identity Isolation on unsupported devices, restarting, and, if needed, repairing the secure channel.
Key points
- Microsoft says the September 2026 updates cause Windows to honor existing or policy-provisioned Machine Identity Isolation enforcement settings, leading to domain trust and sign-in failures on some systems.
- The issue affects some Windows 11 enterprise devices using valid domain credentials, particularly outside environments with Windows Server 2025 Domain Functional Level or higher.
- Admins should disable Machine Identity Isolation using the same management method that enabled it, such as Intune, Group Policy, or the registry.
- For registry-configured devices, Microsoft says to change MachineIdentityIsolation from 2 to 0 in either of the specified registry paths, then restart the device.
- Admins may need to repair the secure channel with Test-ComputerSecureChannel -Repair -Credential (Get-Credential).
- Microsoft is working on a future Windows update to temporarily prevent enforcement; the article does not say the issue has been fully resolved.
Article Details
- Event Type
- Microsoft disclosed a Windows 11 domain authentication issue caused by the September 2026 security updates and provided a temporary workaround.
- Impact
- Some enterprise Windows 11 systems experience broken domain trust and prevent users from signing in with valid domain credentials. The issue affects unsupported environments using Machine Identity Isolation enforcement; Microsoft advises disabling the feature on affected devices and restarting them, with a secure-channel reset potentially required.
Vendors
Products
IntuneFor instance, admins must disable Machine Identity Isolation with Intune if it was enabled by Intune policy and with group policy if it was enabled by group policy.Windows 11Microsoft has shared a temporary workaround for a Windows 11 issue caused by the September 2026 security updates that blocks some users from signing in with valid domain credentials.Windows Server 2025The problem is tied to Machine Identity Isolation enforcement and can break domain trust on affected enterprise systems, especially outside Windows Server 2025 DFL environments.