Microsoft is looking into complaints that the Windows 11 KB5124008 security patch is disrupting domain trust relationships across some corporate environments, leaving users unable to authenticate with legitimate domain credentials.
System administrators posting on Reddit and Microsoft's support forums describe a pattern in which machines lose their secure channel connection to Active Directory once the Windows 11 update is deployed and rebooted.
The company acknowledged the issue to BleepingComputer last week. "Microsoft is aware of these reports and is investigating. We will share guidance as it becomes available," a Microsoft spokesperson said.
Although Microsoft has not pinpointed the underlying cause, evidence points toward the Windows Machine Identity Isolation security feature as the culprit, particularly when configured in audit or enforcement mode.
How domain trust fails after KB5124008
In an Active Directory environment, domain-joined machines rely on machine account credentials to establish and maintain a secure channel with domain controllers. When the locally stored credentials diverge from what Active Directory has on file, the secure channel breaks. This breakdown manifests as domain trust errors or login rejections, even when the user's credentials are correct.
Windows administrator Alex Turner reported on Microsoft's Q&A forums that Windows 11 25H2 machines functioned normally before KB5124008 arrived. Following the update's installation, the workstations began rejecting domain logins after restarting.
Turner noted that cached credentials still functioned while machines were disconnected from the network, suggesting the root problem lay in domain authentication rather than user passwords. His testing confirmed that the machine's secure channel to Active Directory had indeed broken, and the issue could be reliably reproduced. Removing KB5124008 and repairing the domain relationship restored functionality; reinstalling the update caused the failure to recur.
A Reddit administrator reported that 11 out of roughly 256 Windows 11 25H2 Enterprise machines lost domain trust after the update. The same administrator documented numerous Kerberos authentication failures followed by fallbacks to NTLM and Netlogon on the affected systems.
A third administrator stated that all Windows 11 25H2 workstations in their network began rejecting valid domain credentials following the update installation.
Machine Identity Isolation emerges as likely cause
Turner eventually traced the failures to a Windows security mechanism called Machine Identity Isolation, which he discovered had been set to '2'—enforcement mode—after KB5124008 was installed.
Another administrator investigating independently observed the same pattern, finding that 'MachineIdentityIsolation' had been switched to '2' post-update. Disabling the feature prevented Windows from discarding the machine account LSA secret without requiring KB5124008 removal.
This feature belongs to Windows' Virtualization-Based Security and Credential Guard infrastructure and serves to isolate machine account credentials that domain-joined computers use for Active Directory authentication. When set to enforcement mode, Windows transfers the machine account secret into Credential Guard and deletes the copy stored in LSA.
The setting is controlled via this registry location:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "MachineIdentityIsolation"
Workarounds and cautions
Some administrators have recovered affected systems by setting 'MachineIdentityIsolation' to '0', restarting the machine, and then repairing the secure channel through PowerShell.
Administrator Marcel Zehnder shared that running the following command with administrator privileges restored the secure channel after disabling the feature:
Test-ComputerSecureChannel -Repair -Credential(Get-Credential)
After a reboot, I had to restore the secure channel by 'Test-ComputerSecureChannel -Repair -Credential(Get-Credential)'. Since then, the computer is running without loosing the secure channel anymore.
Marcel Zehnder
However, administrators should exercise caution when disabling Machine Identity Isolation, as this action can itself trigger similar problems.
One administrator cautioned that switching the setting from audit or enforcement mode to disabled resulted in domain trust failures across their entire environment, including on machines that had never received KB5124008.
Microsoft's own guidance warns that if Machine Identity Isolation was previously enabled in enforcement mode, disabling it will break domain authentication and necessitate unjoining and rejoining the device to the domain.
Microsoft has not yet confirmed Machine Identity Isolation as the root cause of the KB5124008 failures and has not released an official workaround. Additional details are expected as the investigation progresses.