Microsoft Investigates Windows 11 Update That Breaks Domain Trust for Some Systems
Summary
Microsoft is investigating reports that Windows 11 KB5124008 causes domain trust failures on some enterprise systems after reboot. Administrators suspect Machine Identity Isolation, but Microsoft has not confirmed the cause or issued official guidance.
Key points
- Administrators report that some Windows 11 25H2 devices lose their Active Directory secure channel after installing KB5124008 and rebooting.
- Affected users may be unable to log in with valid domain credentials, while cached credentials reportedly still work offline.
- One administrator reported 11 affected devices among approximately 256; other reports describe broader impact within individual networks.
- Administrators suspect Machine Identity Isolation in audit or enforcement mode, but Microsoft has not confirmed it as the cause.
- Some administrators report restoring access by disabling the feature and repairing the secure channel; Microsoft documentation warns that disabling it after enforcement mode may break domain authentication.
- Microsoft is investigating and has not published an official workaround.
Article Details
- Event Type
- Reported Windows 11 security update issue affecting domain trust and authentication
- Impact
- Microsoft is investigating reports that update KB5124008 causes some Windows 11 25H2 enterprise systems to lose their secure channel with Active Directory after reboot, leading valid domain credentials to fail. Administrators report that disabling Machine Identity Isolation and repairing the secure channel restored access in some cases, but Microsoft has not confirmed the root cause or published an official workaround.
People
Vendors
Products
Credential GuardThe feature is part of Windows’ Virtualization-Based Security and Credential Guard configuration and isolates machine account credentials used by domain-joined computers to authenticate with Active Directory.Microsoft Active DirectoryAffected systems lose their secure channel with Active Directory after reboot.Windows 11Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, causing valid domain credentials to fail after reboot.