KB5124008 starts enforcing Machine Identity Isolation, a feature only supported with Windows Server 2025 DCs. If it was already enabled and your DCs are below WS2025 DFL, domain logons will fail.
What is happening
Microsoft released KB5124008 as part of the September 2026 Patch Tuesday cycle, bringing Windows 11 24H2 and 25H2 devices to OS Build 26200.9445. The update itself patches real security vulnerabilities — but it has introduced a serious side effect for organisations running on-premises Active Directory environments where a specific security feature was already enabled.
The issue is with a feature called Machine Identity Isolation. KB5124008 does not enable this feature — but it does change how Windows behaves when the feature is already configured. After installing the update, Windows begins honouring any existing Machine Identity Isolation settings that were previously provisioned via Intune, Group Policy, or the registry. If those settings were in place but the domain controllers were not running at the required Windows Server 2025 Domain Functional Level, the domain trust relationship breaks and logons fail.
What is Machine Identity Isolation?
Machine Identity Isolation is a security feature for Credential Guard protected machine accounts. It isolates a device's machine account credentials from other credentials on the system, making it harder for attackers to extract and misuse the machine identity. It is part of the Credential Guard / LAPS hardening story for highly-secured environments.
The critical constraint: Machine Identity Isolation is only supported when domain controllers are operating at Windows Server 2025 Domain Functional Level (DFL) or higher. Below that DFL, the feature is not compatible with the domain's authentication infrastructure. Enabling it on client devices without the corresponding DFL causes the machine secure channel to fail when KB5124008 (or any later update) starts enforcing it.
Most organisations did not intentionally enable this feature. However, it can be enabled as part of a Credential Guard or DeviceGuard policy, a security baseline, or a registry configuration — sometimes without the admin realising that Machine Identity Isolation was included.
Who is affected
This issue is conditional on three factors being true simultaneously:
| Factor | Affected? |
|---|---|
| Windows 11 24H2, 25H2, or 26H1 with KB5124008 or later installed | ✅ Yes — this is the trigger |
| Machine Identity Isolation already enabled (via Intune, GPO, or registry) before the update | ✅ Yes — this is the condition |
| Domain controllers below Windows Server 2025 Domain Functional Level | ✅ Yes — this is what makes it break |
| Machine Identity Isolation NOT enabled | ❌ Not affected — no action needed |
| Domain controllers at Windows Server 2025 DFL | ❌ Not affected — MII is supported at that level |
| Entra ID joined only (no on-prem AD) | ❌ Not affected |
| Windows 11 23H2 or earlier | ❌ Not affected by this specific issue |
If your environment has Windows 11 24H2 or 25H2 devices joined to Server 2019 or Server 2022 domain controllers and Machine Identity Isolation was configured somewhere in your Group Policy, Intune, or registry, you are exposed. If MII was never enabled, you are not affected regardless of your DC version.
How to tell if your devices are affected
The most visible symptom is that users cannot log in interactively. They receive: “The trust relationship between this workstation and the primary domain failed.” The device is physically fine — only the domain authentication channel is broken.
Check whether Machine Identity Isolation is enabled on a device (run before deploying KB5124008):
If either path returns 2, Machine Identity Isolation is in enforcement mode on that device and it will fail after KB5124008 is installed.
Check whether the secure channel is already broken (after the update was installed):
On the domain controller side, affected logon attempts produce Event ID 4625 in the Security log with status 0xC000006D.
How to fix it: three paths depending on how MII was enabled
The fix is to disable Machine Identity Isolation using the same method that was used to enable it. Microsoft has published workarounds for all three delivery paths.
Path 1 — Machine Identity Isolation was enabled via Intune (CSP)
Navigate to the Intune policy that configured Machine Identity Isolation and set the value to Disabled. The Intune CSP path is:
- OMA-URI:
./Device/Vendor/MSFT/Policy/Config/DeviceGuard/MachineIdentityIsolation - Set the value to 0 (Disabled / Not Configured)
Sync the policy to affected devices, then restart each device and run Test-ComputerSecureChannel -Repair as described in the final step below.
Path 2 — Machine Identity Isolation was enabled via Group Policy
Locate the GPO that set Machine Identity Isolation and either disable or remove the setting. The GPO path is typically found under:
- Computer Configuration › Administrative Templates › System › Device Guard
Run gpupdate /force on affected devices after the policy change, then restart and run Test-ComputerSecureChannel -Repair.
Path 3 — Machine Identity Isolation was set directly in the registry
Final step (all paths) — repair the secure channel after restart
Test-ComputerSecureChannel -Repair as a separate user-context script after the restart to rebuild the channel with domain credentials.Microsoft's response and next steps
Microsoft has acknowledged this as a known issue affecting Windows 11 24H2, 25H2, and 26H1. The status on the Windows release health dashboard is Mitigated — meaning a workaround is available (as documented above) but the full fix has not yet shipped in a Windows update.
Microsoft's stated next step: a future Windows update will temporarily prevent Machine Identity Isolation enforcement while improvements are made to the feature.
Until that update ships, the workaround is to disable Machine Identity Isolation using whichever method originally enabled it, as described above.
For further reading:
- Windows 11 25H2 release health — issue 4990: Domain-joined devices might lose their secure trust relationship
- Windows 11 24H2 release health — same issue tracked on the 24H2 dashboard
- Machine Identity Isolation documentation (Microsoft Learn)
- DeviceGuard/MachineIdentityIsolation CSP reference (Microsoft Learn)
This post will be updated when Microsoft releases the permanent fix in a future cumulative update. Last updated: 17 September 2026.