Windows 11 KB5124008 Update Breaks Active Directory Domain Trust and Blocks User Logins

Microsoft is investigating reports that the Windows 11 cumulative security update KB5124008 (released Sept 8, 2026) is breaking Active Directory domain trust on some enterprise machines by triggering Machine Identity Isolation (Credential Guard) enforcement and preventing machine-account authentication. Administrators reproduced secure-channel failures and mitigations reported by the community include disabling Machine Identity Isolation, uninstalling the update, resetting machine passwords, or rejoining the domain; organizations are advised to pause broad deployment, preserve local admin/LAPS access, test changes on limited groups, and monitor Microsoft guidance.