Microsoft Shares a Workaround After a Windows 11 Update Breaks Domain Sign-Ins

Microsoft has published a temporary fix for a bug that can lock Windows 11 users out of their machines after installing the September 2026 security updates, KB5124008 or KB5124012 depending on the OS version. Affected devices lose their secure channel with an on-premises Active Directory domain, leaving users unable to sign in interactively with valid domain credentials — instead seeing an error that the trust relationship between the device and the domain has failed.

Microsoft traced the failures to its Machine Identity Isolation security mechanism, which the September updates switched into full enforcement mode. The company's workaround involves manually editing the registry — setting the value at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation (or the equivalent Group Policy path) from 2 to 0, restarting the device, and then repairing the secure channel with Test-ComputerSecureChannel -Repair.

Users who can still authenticate offline with cached credentials are largely unaffected day-to-day, but IT administrators managing domain-joined fleets are advised to apply the workaround proactively. Microsoft says it plans to resolve the issue permanently in an upcoming update by temporarily easing Machine Identity Isolation enforcement while it refines the feature.

Photo via Wikimedia Commons, © Shixart1985, licensed under CC BY 2.0.