GoKawiilMicrosoft probes KB5124008 update for breaking Active Directory domain trust
Microsoft confirmed it is investigating reports that the Windows 11 KB5124008 security update is severing secure channel connections between domain-joined PCs and Active Directory after a reboot, locking out users with valid credentials. Administrators on Reddit and Microsoft's Q&A forums say the problem appears tied to the Windows Machine Identity Isolation feature when running in audit or enforcement mode, and that uninstalling the patch and repairing the domain trust restores access.
GoKawiil's interpretation of the reporting above, not reported fact.
For enterprises, a broken domain trust relationship can halt logins across entire fleets of machines, creating costly downtime and support burden for IT teams. The issue highlights the risk that security-hardening features meant to protect machine identities can themselves introduce authentication failures if not thoroughly tested against real-world Active Directory environments.
- KB5124008 is causing domain-joined Windows 11 PCs to lose secure channel trust with Active Directory.
- The bug appears linked to the Windows Machine Identity Isolation feature in audit or enforcement mode.
- Microsoft is investigating; affected admins can currently work around it by uninstalling the update and repairing the domain trust.
Source: bleepingcomputer.com, 2026-09-16
Published there as: “Windows 11 KB5124008 update breaks domain trust for some users”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.