Last updated:
The September 2026 update brings another surprise. This time, I experienced it directly in a customer environment.
After the Windows update, certain domain-joined Windows 11 systems suddenly lose their trust relationship with Active Directory.
❌ Domain trust failure
❌ Logon fails despite valid credentials
❌ Secure channel to the domain controller is broken
The cause: Machine Identity Isolation
With KB5124008, Windows honors existing Machine Identity Isolation settings. The problem: this feature requires an AD environment at the Windows Server 2025 domain functional level.
If the feature is already enabled through GPO, Intune or the registry even though that requirement is not met, the trust relationship may be lost.
What helps?
1. Check Machine Identity Isolation and the existing policies.
2. In an unsupported AD environment, disable the feature through the original management method.
3. Restart affected systems.
4. Then repair the secure channel.
PowerShell:
|
1 2 |
Test-ComputerSecureChannel -Repair -Credential (Get-Credential) |
⚠️ Important: disabling the feature alone does not repair an already broken trust relationship.
My learning from practice:
If domain trust issues suddenly occur after the September patch, do not immediately remove the computer from the domain and join it again.
Check Machine Identity Isolation first!
Another example of how a security feature can become an operational issue when its infrastructure prerequisites are not met.
