Windows 11 devices on corporate domains risk refusing valid domain logins after the September 2026 security updates, leaving users facing domain trust and credential errors even when usernames and passwords are correct.
How Microsoft says the September updates trigger the problem
Microsoft confirmed that the September 2026 security updates cause Windows to begin honoring existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement, producing domain trust failures and sign-in issues for affected machines. The company said on its release health dashboard: "While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement."
Microsoft tied the behavior to this month's patches KB5124008 (Windows 11 24H2/25H2) and KB5124012 (Windows 11 26H1). Administrators investigating the outages linked failures to the Machine Identity Isolation security mechanism being set to enforcement mode after those updates were installed.
Scope, support limits, and the required action Microsoft lays out
According to Microsoft, Machine Identity Isolation enforcement is supported only for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above; the feature "should be disabled elsewhere." The company said admins must disable Machine Identity Isolation on all devices previously configured to use it that are not connected to Windows Server 2025 domain controllers.
Microsoft's documentation also warns that enabling Machine Identity Isolation in enforcement mode and then disabling it will break domain authentication and require the device to be unjoined and rejoined to the Windows domain — a disruption administrators should factor into any mitigation plan.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWorkaround: disabling Machine Identity Isolation (group policy, Intune, or registry)
Microsoft shared a temporary workaround that requires disabling the Machine Identity Isolation feature using the same management method used to enable it — for example, group policy or Intune policy. For devices where the feature was enabled directly in the Windows registry, Microsoft published these steps:
- On a Windows 11 (version 24H2 or 25H2) device, locate the following registry paths:
- HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation
- HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation
- If the value for MachineIdentityIsolation = 2 at either key, set MachineIdentityIsolation = 0.
- Restart the device.
- Reset the secure channel by running: 'Test-ComputerSecureChannel -Repair -Credential (Get-Credential)'.
Microsoft also said it is working on a resolution that will temporarily prevent Machine Identity Isolation enforcement in a future Windows update.
Out-of-band updates for other September regressions and outstanding audio problems
Separately, Microsoft released out-of-band Windows updates on Monday to address Remote Desktop Services failures, Hyper-V issues, and USB audio problems that were introduced by September's security updates. Those emergency updates did not resolve all audio problems, and Microsoft is still working on a fix for the remaining audio issues.
What this means for enterprise admins, endpoint teams, and end users
- Enterprise admins: review domain controller levels and identify devices that were configured for Machine Identity Isolation; disable the feature on machines not connected to Windows Server 2025 DFL controllers and plan for unjoin/rejoin if enforcement state changes have already occurred.
- Endpoint/security teams: verify whether Machine Identity Isolation was enabled via group policy, Intune, or registry and apply the same management method to disable it; follow Microsoft's registry steps and the Test-ComputerSecureChannel command where applicable.
- End users: expect that some devices may fail to accept valid domain credentials until administrators apply the workaround or Microsoft issues a broader fix; affected machines may require a restart and, in some cases, domain unjoin/rejoin.
Microsoft has acknowledged the root cause and provided a tangible, if disruptive, mitigation: disable Machine Identity Isolation where it is unsupported and follow the registry or policy steps if necessary. The company says it will also prevent enforcement in a future update and continues to work on residual regressions from the September releases.
Original reporting: BleepingComputer — Microsoft releases workaround for Windows domain login authentication issues
