Affected Systems

Windows 11 versions 24H2, 25H2, and 26H1 after installing September 2026 security updates (KB5124008, KB5124012). Affects enterprise environments with domain-joined devices NOT connected to Windows Server 2025 domain controllers. Machine Identity Isolation feature is only supported with Windows Server 2025 Domain Functional Level and above.

Exploitation Status

Not a vulnerability; this is a configuration issue triggered by September 2026 Windows updates that enforce Machine Identity Isolation settings. No exploitation involved. Widespread impact reported by enterprise users and IT administrators on Microsoft forums and Reddit.

Business Impact

Domain authentication failures prevent users from logging into Windows 11 workstations with valid credentials, causing immediate productivity loss in enterprise environments. Domain trust relationships break on affected systems. Issue only impacts organizations that previously configured Machine Identity Isolation but are not running Windows Server 2025 domain controllers. Microsoft is working on a future update to temporarily prevent enforcement, but no timeline provided.

Urgency

🔴 Immediate

Recommended Actions

  • Identify all Windows 11 devices (24H2, 25H2, 26H1) with Machine Identity Isolation enabled via registry query: check HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation for value = 2
  • Disable Machine Identity Isolation using the same method that enabled it (Intune policy, Group Policy, or registry). For registry: set MachineIdentityIsolation = 0 at both registry paths, then restart the device
  • After disabling and restarting, reset the secure channel on each affected device using PowerShell command: Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
  • If running Windows Server 2025 domain controllers at Domain Functional Level 2025 or higher, Machine Identity Isolation is supported and can remain enabled; otherwise disable on all domain-joined devices
  • Monitor Microsoft release health dashboard for permanent fix that will prevent Machine Identity Isolation enforcement in future Windows update