Windows 11 26H2: Domain-joined devices may lose their trust relationship with the domain
Summary
After installing Windows 11 version 26H2, Credential Guard protected machine accounts may lose their secure channel to an on-premises Active Directory domain. The cause is Machine Identity Isolation (MII), which Windows now honours; it is only supported with Windows Server 2025 domain controllers at Domain Functional Level 2025 or above. Microsoft has resolved the issue with updates released on 2026-09-22 and later.
Symptoms
Users cannot sign in interactively with valid domain credentials and may see a message that the trust relationship between the device and the domain failed. Sign-in with previously cached credentials may still work. AD replication and AD services on the domain controllers are not affected.
Affected
- Windows 11, version 26H2
- Windows 11, version 26H1 (originating updates KB5124012 and KB5129194)
- Windows 11, version 25H2 and 24H2 (originating updates KB5124008 and KB5129195)
- Devices configured for Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers
- Windows Server: not affected
Workaround
Not needed with KB5124010 (26H2/25H2/24H2) or KB5124006 (26H1), or later updates. For older updates:
- Known Issue Rollback: install the Group Policy download "KB5124008 260915_17123 Known Issue Rollback" (26H2, 25H2, 24H2), set "KB5124008 260915_17123 Known Issue Rollback" under Computer Configuration > Administrative Templates to Disabled and restart the devices.
- Alternatively disable Machine Identity Isolation using the method that enabled it (Intune policy or Group Policy).
- If it was enabled directly in the registry, check HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation; where MachineIdentityIsolation = 2, set it to 0.
- Restart the device.
- Reset the secure channel with: Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
Fix
Resolved by Windows updates released 2026-09-22 (KB5124010) and later. They prevent MII enforcement completely, regardless of its configuration, while the feature is being improved.
Recommendation
Install the 2026-09-22 update or a later one on all Windows 11 clients. Repair the secure channel of devices that have already lost it. Only use Machine Identity Isolation if all domain controllers run Windows Server 2025 at Domain Functional Level 2025 or above.
Reports from the community and trade media
Reports from forums, Q&A sites, Reddit and trade media – linked only, without the names of the authors; the vendor’s statement is authoritative.
- Windows 11 KB5124008 update breaks domain trust for some users News · bleepingcomputer.com, 1 Nov 2026
- KB5124008 Windows 11 Domänen-Vertrauensstellung defekt News · windows-faq.de, 17 Sep 2026
- Windows 11 Update Domain Trust Problem Workaround News · it-administrator.de, 1 Nov 2026
- KB5124008 26200.9445 breaks machine secure channel Community · learn.microsoft.com, 9 Sep 2026
- Windows 11 26H2 release health Vendor · learn.microsoft.com, 8 Oct 2026
Sources
- Windows release health: Windows 11, Version 26H2 Vendor · learn.microsoft.com
- Windows release health: Windows 11, Version 26H1 Vendor · learn.microsoft.com
- Windows release health: Windows 11, Version 25H2 Vendor · learn.microsoft.com
- Windows release health: Windows 11, Version 24H2 Vendor · learn.microsoft.com
- KB5124010 Vendor · support.microsoft.com
- Credential Guard protected machine accounts Vendor · learn.microsoft.com
- How to use Group Policy to deploy a Known Issue Rollback Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:56.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.