Microsoft shares workaround for Windows domain login issues

Microsoft shared a temporary fix on Wednesday for a known issue that prevents Windows 11 users from logging in with valid domain credentials after installing the September 2026 security updates.

According to widespread reports from users and IT administrators on Microsoft's Q&A forums, Reddit, and other online platforms, this bug breaks domain trust relationships on some enterprise systems and causes affected users to see domain trust errors and credential errors even though their usernames or passwords are valid.

Admins who investigated this issue have linked the failures to the Machine Identity Isolation Windows security mechanism, which is being set to enforcement mode after this month's KB5124008 (Windows 11 24H2/25H2) or KB5124012 (Windows 11 26H1) updates are installed.

Microsoft's documentation also warns that enabling Machine Identity Isolation in enforcement mode and then disabling it will break domain authentication and require the device to be unjoined and rejoined to the Windows domain.

On Wednesday, Microsoft confirmed that these authentication issues are triggered by the September 2026 security updates that enable Machine Identity Isolation, causing domain trust failures and sign-in issues with valid domain credentials.

"While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement," it said in a release health dashboard update.

"However, this feature is only supported for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above. The feature should be disabled elsewhere."

According to Microsoft, admins must disable Machine Identity Isolation on all devices previously configured to use it and that are not connected to Windows Server 2025 domain controllers.

Workaround available

While Microsoft is still working to resolve this issue by temporarily preventing Machine Identity Isolation enforcement in a future Windows update, it has shared a temporary fix that should help affected customers work around these authentication problems.

This requires disabling the Machine Identity Isolation feature using the same management method used to enable it. For instance, admins must disable Machine Identity Isolation with Intune if it was enabled by Intune policy and with group policy if it was enabled by group policy.

If Machine Identity Isolation was enabled directly in the Windows registry, you can use the following steps to disable it:

1. On a Windows 11 (version 24H2 or 25H2) device, locate the following registry paths: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation 2. For either of these registry keys, if the value for MachineIdentityIsolation = 2, then set MachineIdentityIsolation = 0. 3. After you disable Machine Identity Isolation, restart the device. 4. Then reset the secure channel using the following command: 'Test-ComputerSecureChannel -Repair -Credential (Get-Credential)'

On Monday, Microsoft also released out-of-band Windows updates to fix Remote Desktop Services failures, Hyper-V issues, and USB audio problems caused by this month's security updates.

However, these emergency updates did not resolve all the audio problems introduced by the September 2026 updates, and the company is still working on a fix for the remaining issues.