Windows 11 Update Breaks Domain Trust

Enterprise workstations running Windows 11 25H2 began failing domain logins after installing a routine security update, according to reports from system administrators. The failures leave machines unable to authenticate valid domain credentials, forcing users to rely on cached logins while offline. Microsoft says it is investigating.

The update at the center of the reports is KB5124008, a Windows 11 security patch. Administrators say the problem appears after installation and a reboot, when affected computers lose their secure channel with Active Directory.

What Administrators Are Seeing

In a Windows Active Directory environment, domain-joined computers use machine account credentials to maintain a secure channel with domain controllers. When those locally stored credentials no longer match what Active Directory expects, the channel fails and users are told their username or password is incorrect even though the credentials are valid.

The reports surface on Reddit and on Microsoft's Q&A forums, where administrators describe losing domain trust after patching and rebooting.

Microsoft confirmed to BleepingComputer that it is aware of the reports. The company has not published a root cause or an official workaround.

Microsoft Acknowledges the Reports

Asked about the failures, Microsoft told BleepingComputer it had taken note and was looking into them.

"Microsoft is aware of these reports and is investigating. We will share guidance as it becomes available," Microsoft told BleepingComputer.

— Microsoft, in a statement to BleepingComputer

That statement leaves the cause unconfirmed. It also means there is no vendor-endorsed fix at the time of writing.

A Repeatable Failure, Not a Fluke

Alex Turner, a Windows administrator who reported the issue on Microsoft's Q&A forums, said Windows 11 25H2 workstations worked normally before KB5124008 was installed. After the update, the devices began having domain login failures following a reboot.

Cached credentials kept working while the systems were offline, which pointed to domain authentication rather than the users' passwords. Turner said testing showed the computer's secure channel with Active Directory had broken, and that the issue could be reproduced consistently.

Uninstalling KB5124008 and repairing the domain relationship restored access. Reinstalling the update brought the failure back.

How Many Machines Are Affected

The reported impact varies by environment:

• One administrator on Reddit said 11 Windows 11 25H2 Enterprise devices out of approximately 256 devices lost domain trust after being updated.
• That same administrator found numerous Kerberos authentication failures followed by NTLM and Netlogon fallbacks on affected systems.
• Another administrator said every Windows 11 25H2 workstation on their network began rejecting valid domain credentials after installing the updates.

The failures are not uniform across every fleet, according to these accounts.

The Feature Under Suspicion

Turner later linked the failures to a Windows security setting called Machine Identity Isolation, which he said was set to '2', or enforcement mode, after KB5124008 was installed.

Another administrator investigating the issue reported seeing the same behavior, saying 'MachineIdentityIsolation' was set to '2' after the update. That administrator said disabling the feature stopped Windows from discarding the machine account LSA secret, without requiring KB5124008 to be removed.

The feature is part of Windows' Virtualization-Based Security and Credential Guard configuration. It isolates machine account credentials used by domain-joined computers to authenticate with Active Directory.

In enforcement mode, Windows moves the machine account secret into Credential Guard and removes the copy stored in LSA. The Microsoft documentation covers the mechanism.

The setting can be controlled through the following registry value:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"MachineIdentityIsolation"

What Some Administrators Did to Recover

Some administrators restored affected systems by setting 'MachineIdentityIsolation' to '0', rebooting, and then repairing the machine's secure channel using PowerShell.

One administrator said the following PowerShell command, run as administrator, restored the secure channel after disabling the feature:

Test-ComputerSecureChannel -Repair -Credential(Get-Credential)

Marcel Zehnder described the result.

"After a reboot, I had to restore the secure channel by 'Test-ComputerSecureChannel -Repair -Credential(Get-Credential)'. Since then, the computer is running without loosing the secure channel anymore," explained Marcel Zehnder.

— Marcel Zehnder, Windows administrator

Disabling It Carries Its Own Risk

Administrators should be careful about disabling Machine Identity Isolation, because doing so could cause similar problems.

Another administrator warned that changing the setting from audit or enforcement mode to disabled caused domain trust failures across their environment, including on systems that had never installed KB5124008.

Microsoft's documentation also warns that if Machine Identity Isolation was previously enabled in enforcement mode, disabling it will break domain authentication and require the device to be unjoined and rejoined to the domain.

Microsoft has not yet confirmed that Machine Identity Isolation is the root cause of the KB5124008 failures, and the company has not published an official workaround.

What Happens Next

BleepingComputer says it will update the story when Microsoft provides additional information about its investigation.

Until then, administrators are working from community reports rather than vendor guidance. The correlation between enforcement mode and the failures is drawn from administrator testing, not from a Microsoft root-cause analysis.

For now, the practical picture is limited: a patch that appears to trigger the loss of domain trust on some systems, a security feature that administrators say flipped into enforcement mode, and a repair command that has worked for some but not all. Microsoft's investigation is the piece still missing.