Microsoft confirmed a known issue after the September 2026 security updates. On some domain-joined Windows 11 PCs, users cannot sign in with valid domain credentials. Cached offline credentials may still work. The secure channel between the PC and Active Directory is what fails.
The updates most often named in coverage are KB5124008 for Windows 11 24H2 and 25H2, and KB5124012 for Windows 11 26H1. Reports and Microsoft’s release-health notes point to Machine Identity Isolation. That setting can move into enforcement after the update honors a policy that was already provisioned. The update does not have to invent a brand-new setting for the failure to show up.
Microsoft published a temporary workaround. Disable Machine Identity Isolation through the same management path that turned it on, such as Intune or Group Policy. Restart the PC. Then repair the secure channel. One common repair command is Test-ComputerSecureChannel -Repair with an elevated PowerShell session and domain credentials. Microsoft also warns that flipping the feature from enforcement to disabled can itself break authentication on some fleets. Unjoining and rejoining the domain may be required in those cases.
Chandler companies that patched this week should pause before the usual panic moves. Failed domain logins after KB5124008 or KB5124012 often look like a bad password or a dead PC. They are frequently a broken secure channel tied to Machine Identity Isolation. Confirm which KB landed. Confirm whether that isolation setting was ever turned on through Intune or Group Policy. Keep a local admin path ready while you disable the setting through the original management channel, restart, and repair the trust. Leave the September security updates installed unless Microsoft guidance for your exact case says otherwise.
If helpdesk tickets are stacking up after patch night, My I.T. Consultants can walk the recovery with you. Call 903-675-5431 for a Free Assessment. Weekday office hours are Monday through Friday, 7:00 a.m. to 6:00 p.m. Contract customers stay covered 24/7.
