On Wednesday, Microsoft released guidance addressing a significant authentication problem that emerged following the deployment of September 2026 security updates to Windows 11. The issue prevents users from accessing systems using valid domain credentials, with reports surfacing across Microsoft's support forums, Reddit, and other community channels from both individual users and IT administrators.

The root cause centers on domain trust relationships being severed on certain enterprise deployments. Users encountering the problem receive error messages related to domain trust and credential validation failures, despite providing correct authentication information. Investigation by system administrators traced the failures to Machine Identity Isolation, a Windows security feature that became enforced following installation of KB5124008 (Windows 11 24H2/25H2) or KB5124012 (Windows 11 26H1).

Microsoft's own documentation cautioned that enabling Machine Identity Isolation in enforcement mode followed by disabling it will sever domain authentication capabilities, necessitating the device to be removed from and rejoined to the Windows domain.

In its official confirmation, Microsoft stated that "While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement." The company emphasized that "this feature is only supported for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above. The feature should be disabled elsewhere."

According to Microsoft's guidance, administrators must deactivate Machine Identity Isolation across all devices that were previously configured with this setting and lack connectivity to Windows Server 2025 domain controllers.

Workaround available

While Microsoft develops a permanent resolution through a forthcoming update that will temporarily block Machine Identity Isolation enforcement, the company has provided an interim solution for affected organizations.

The workaround involves disabling Machine Identity Isolation through the same administration tool that originally enabled it. Organizations using Intune policies must disable the feature through Intune, while those using group policy must use group policy to disable it.

For devices where Machine Identity Isolation was enabled directly through the Windows registry, administrators can follow these steps:

  1. On a Windows 11 device running version 24H2 or 25H2, navigate to these registry locations: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation
  2. If either registry key contains a value of MachineIdentityIsolation = 2, change it to MachineIdentityIsolation = 0
  3. Restart the affected device after disabling Machine Identity Isolation
  4. Execute the following command to restore the secure channel: 'Test-ComputerSecureChannel -Repair -Credential (Get-Credential)'

Microsoft released out-of-band updates on Monday addressing Remote Desktop Services failures, Hyper-V complications, and USB audio issues stemming from the September 2026 security patches. However, these emergency releases did not fully resolve all audio-related problems introduced by the updates, and Microsoft continues work on addressing the remaining audio issues.