GoKawiilMicrosoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials.
Administrators report on Reddit and Microsoft's Q&A forums that affected computers lose their secure channel with Active Directory after the Windows 11 update is installed and devices reboot.
Last week, Microsoft confirmed to BleepingComputer that it is aware of the reports and is investigating.
"Microsoft is aware of these reports and is investigating. We will share guidance as it becomes available," Microsoft told BleepingComputer.
While Microsoft has not confirmed the root cause, reports indicate that the failures are linked to the Windows Machine Identity Isolation security feature, especially when it is enabled in audit or enforcement mode.
Domain trust breaks after installing KB5124008
In Windows Active Directory, domain-joined computers use machine account credentials to maintain a secure channel with domain controllers.
If those locally stored credentials no longer match what Active Directory expects, the secure channel can fail. This can cause users to receive domain trust errors or be told their username or password is incorrect even though their credentials are valid.
Alex Turner, a Windows administrator who reported the issue on Microsoft's Q&A forums, said Windows 11 25H2 workstations worked normally before KB5124008 was installed. However, after installing the update, the devices started having domain login failures after a reboot.
Cached credentials continued to work while the systems were offline, indicating the problem was tied to domain authentication rather than the users' passwords.
... continue reading