A Windows 11 update is locking staff out of their own work computers

Key points

• Microsoft is investigating reports that its Windows 11 update KB5124008 is stopping some office computers from accepting valid company logins after a reboot.
• Administrators trace the fault to a security feature called Machine Identity Isolation, which the update appears to switch into enforcement mode.
• One IT team reported 11 out of roughly 256 Windows 11 25H2 Enterprise machines lost their link to the company network after installing the patch.
• A temporary fix involves setting the feature off in the Windows registry, rebooting, then running a PowerShell repair command.
• Microsoft has not published an official workaround and has not confirmed the root cause.

Microsoft is looking into complaints that its latest Windows 11 security update is doing something no security update should do: locking staff out of the company network.

The update, KB5124008, went out on 11 November 2025. On some enterprise machines running Windows 11 25H2, it breaks the invisible handshake that a work computer uses to prove to the company's network that it is a trusted device. When that handshake fails, users type in the right password and get told it's wrong. Microsoft confirmed to BleepingComputer that it's investigating and will share guidance as it becomes available.

What actually breaks?

Every office PC joined to a corporate network has its own machine password, separate from the user's password, that it uses to check in with the company's directory servers. If that machine password stops matching what the servers expect, the PC is effectively locked out, and so is anyone trying to log in.

That's what administrators say is happening after installing KB5124008. Cached logins still work while the machine is offline, which points the finger at the network handshake rather than the user's credentials.

Administrator Alex Turner wrote on Microsoft's Q&A forum that his Windows 11 25H2 workstations were fine until the update landed. After a reboot, they started rejecting valid domain logins. Uninstalling the update fixed it. Reinstalling broke it again.

Another IT team on Reddit said 11 out of about 256 Windows 11 25H2 Enterprise devices lost their network trust after patching. A third reported that every Windows 11 25H2 machine on their network started refusing valid credentials.

Why is it happening?

The likely culprit is Machine Identity Isolation, a Windows security feature that hides the machine password inside a protected area called Credential Guard. Administrators report that KB5124008 flips this feature into enforcement mode, which is where the trouble starts.

In enforcement mode, Windows moves the machine password into the vault and deletes the old copy, then behaves as if it has forgotten how to introduce itself to the network.

Turner and others found the registry value MachineIdentityIsolation set to 2, meaning enforcement, after the update. Setting it back to 0 and rebooting stopped Windows from discarding those credentials.

How can IT teams fix it?

A workaround exists, but it carries a serious warning. Set MachineIdentityIsolation to 0 in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa, reboot, then run this PowerShell command as an administrator to repair the trust:

Test-ComputerSecureChannel -Repair -Credential(Get-Credential)

Microsoft's own documentation warns that if Machine Identity Isolation was already in enforcement mode before you disabled it, turning it off will itself break domain authentication, requiring the machine to be removed from the network and rejoined. One administrator reported exactly that outcome on machines that had never installed KB5124008.

Should you worry?

We first covered KB5124008 on 8 September 2026, when the update shipped a large security backlog alongside a repositionable taskbar. The domain-trust breakage is a separate and nastier problem.

This looks less like a bug in the patch and more like a feature quietly promoted from optional to mandatory before the surrounding plumbing was ready. Credential Guard has a long history of exactly this kind of collateral damage. Watch for an out-of-band advisory rather than a hotfix: the honest response here is documentation, not code.