Microsoft has confirmed that the September 2026 Patchday security updates for Windows 11 (26H1, 25H2, and 24H2) introduce a new 'Machine Identity Isolation' feature that can lock users out of on-premises Active Directory domain logins.
The issue affects machines with Credential Guard enabled that are not operating in a Windows Server 2025 Domain Functional Level (DFL) environment. After installing the patches, affected machines lose their secure channel to on-premises AD, and users receive a 'trust relationship between this computer and the primary domain failed' error. Offline login with cached credentials still works.
Microsoft explains that the September update enables Machine Identity Isolation by default, which then enforces existing or policy-based settings. However, the feature only supports Windows Server 2025 DFL environments — in all other environments, it should be disabled.
The workaround is multi-step and cumbersome: administrators must set the MachineIdentityIsolation registry value from 2 back to 0 under two registry paths, reboot the machine, and then reset the Secure Channel using the PowerShell command Test-ComputerSecureChannel -Repair -Credential (Get-Credential).
Microsoft says a forthcoming Windows update will temporarily disable enforcement of Machine Identity Isolation and deliver improvements to the feature. This is the latest in a series of troubled Windows updates — Microsoft had previously shipped a belated August Patchday correction that had simply been forgotten during the original release.
