Domain-joined devices might lose their secure trust relationship with the domain
Analysis / inference: Certain Windows updates honor Machine Identity Isolation settings improperly, causing Credential Guard protected machines to lose their domain secure channel.
- Published
- 17 Sept 2026, 02:45 AM IST
- Updated
- 22 Sept 2026, 10:30 PM IST
- Source
- Windows release health · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
September 2026 security and out-of-band updates began honoring pre-configured Machine Identity Isolation policies, which breaks trust relationships if domain controllers are below Windows Server 2025 DFL.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisCredential Guard protected machine accounts may lose their secure trust relationship with active directory domains, blocking interactive sign-ins.
Users may experience interactive sign-in failures with errors stating the trust relationship between the device and domain failed.
Section 03 · Recommended actions
- Install Windows updates released September 22, 2026, or later (such as KB5124010 or KB5124006).
- Apply Known Issue Rollback (KIR) group policies if running older updates.
- Manually set the MachineIdentityIsolation registry key to 0 and repair the secure channel using Test-ComputerSecureChannel if needed.
- Verify whether Windows update KB5124010, KB5124006, or later has been deployed to affected endpoints.
- Check registry paths HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation for a value of 2.