Microsoft has released a temporary workaround for a Windows 11 issue that can prevent users from signing in with valid domain credentials after installing the September 2026 security updates.
The problem has been reported by users and IT administrators who began seeing domain trust and credential errors even when the username and password being used were correct. Microsoft has confirmed that the failures are associated with Machine Identity Isolation, a Windows security feature whose configuration began being enforced after the latest updates.
The affected updates include KB5124008 for Windows 11 24H2 and 25H2 and KB5124012 for Windows 11 26H1. According to Microsoft, the updates do not directly enable Machine Identity Isolation. Instead, Windows begins honoring existing configurations or policies that previously enabled enforcement of the feature.
The problem is particularly important in enterprise environments because Machine Identity Isolation enforcement is supported only when systems are connected to domain controllers operating at Windows Server 2025 Domain Functional Level or newer. Organizations using older domain configurations may therefore encounter authentication failures if the feature was previously configured.
Microsoft Provides a Temporary WorkaroundUntil a permanent fix becomes available, Microsoft recommends disabling Machine Identity Isolation on affected devices that are not connected to compatible Windows Server 2025 domain controllers.
Administrators should disable the feature using the same management mechanism originally used to enable it. For example, environments configured through Microsoft Intune should modify the corresponding Intune policy, while organizations using Group Policy should change the relevant policy there.
For systems where the feature was configured directly through the Windows Registry, administrators can check the relevant Machine Identity Isolation registry entries. A value ofMachineIdentityIsolation = 2indicates enforcement and can be changed to0.
After disabling the feature, Microsoft recommends restarting the affected computer and repairing its secure channel with the domain using PowerShell:
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
This can restore the trust relationship between the workstation and the domain without requiring users to continue troubleshooting credentials that are actually valid.
Another September Update ProblemThe authentication issue adds to several problems associated with Microsoft’s September 2026 Windows updates.
Microsoft has already released emergency out-of-band updates addressing failures involving Remote Desktop Services, Hyper-V and USB audio. Some audio-related problems remain unresolved.
For enterprise IT teams, the domain authentication issue is particularly disruptive because it can prevent employees from accessing managed Windows devices altogether. It also demonstrates why security updates need to be tested against existing Active Directory policies and infrastructure before widespread deployment.
Microsoft says it is working on a more permanent solution that will temporarily prevent Machine Identity Isolation enforcement through a future Windows update. Until then, administrators experiencing domain trust failures after the September updates should review their Machine Identity Isolation configuration before attempting more disruptive recovery procedures.