Windows 11 domain logins broke this week. Here is what actually happened.

Key points

• Microsoft's September 2026 Windows 11 security updates, KB5124008 and KB5124012, are locking users out of company networks even when their passwords are correct.
• The culprit is Machine Identity Isolation, which the update begins enforcing if an administrator ever switched it on.
• The feature only works safely against domain controllers running Windows Server 2025; on older setups it breaks the trust between the PC and the server.
• Microsoft's workaround is to disable Machine Identity Isolation using the same tool that enabled it, then reboot and repair the secure channel.
• Cycling the feature on and then off can leave a PC needing to be removed from the domain and rejoined by hand, which is painful at scale.

A lot of Windows admins spent Wednesday staring at the same error: the username is right, the password is right, and the machine still won't let anyone in.

Microsoft has now confirmed the cause and published a workaround. The September 2026 security updates for Windows 11, shipped as KB5124008 for versions 24H2 and 25H2 and KB5124012 for version 26H1, are quietly starting to enforce a security feature called Machine Identity Isolation. On networks that weren't built for it, that feature breaks the login process.

The issue was first surfaced by BleepingComputer after admins on Microsoft's own Q&A forums and Reddit began comparing notes. We reported the initial lockout pattern on 17 September 2026 in "A Windows 11 update is locking staff out of their own work computers"; this follow-up is about why it happened and what to do.

What is Machine Identity Isolation, in plain words?

Think of a company laptop as having two identities. One belongs to you, the human. The other belongs to the laptop itself, used behind the scenes to prove the machine is a trusted member of the company network.

That machine identity has been a soft target for years. Attackers who get onto a PC can pull it from the registry, a kind of internal settings database, and impersonate the machine to reach service accounts that are supposed to be tightly locked down.

Machine Identity Isolation is Microsoft's fix. It hides that machine credential inside Credential Guard, a protected area of Windows that ordinary software can't read. Microsoft describes the feature as an opt-in hardening measure for service account security.

The catch: it only works against domain controllers, the servers that check who is allowed on the network, running Windows Server 2025 or newer. Point it at anything older and the login handshake falls apart.

Why did this week's update trigger it?

Microsoft is careful about how it phrases this. The update doesn't turn the feature on by itself. What it does is start honouring the setting if any administrator, or any policy, ever enabled it in the past. Plenty of security teams did exactly that, through Intune (Microsoft's cloud management tool), through group policy (the older on-premises equivalent), or by editing the registry directly.

Before September, those settings sat there doing little. After the update, Windows takes them seriously. If the domain controller is older than Windows Server 2025, the PC and the server can no longer agree on who each other is, and users see domain trust errors.

What is the fix?

Disable Machine Identity Isolation using whatever tool enabled it. Intune settings get switched off in Intune. Group policy gets reversed in group policy. Registry edits get undone at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and the matching DeviceGuard key, by setting the value from 2 back to 0.

After the reboot, admins have to run Test-ComputerSecureChannel -Repair -Credential (Get-Credential) in PowerShell to re-establish trust between the PC and the domain.

The plain verdict: this isn't really a bug in Machine Identity Isolation itself. It's a rollout choice. Microsoft shipped an update that started enforcing a setting many admins had forgotten they'd left switched on, without checking whether the surrounding network could cope. For a change that can force a manual rejoin of every affected PC, that's a rough call. Watch whether Microsoft's promised future update, which is meant to temporarily block enforcement, actually ships before more domains are hit.