Loading story…
Microsoft confirmed that recent Windows updates have introduced a critical issue causing Kerberos and NTLM authentication failures on systems with duplicate Security Identifiers (SIDs). The updates, released since August 29, 2025, enforce stricter checks on SIDs, resulting in failed authentication handshakes between devices sharing the same SID. This has led to widespread login issues, including failed remote desktop connections, 'access denied' errors, and unsuccessful login attempts even with valid credentials, particularly affecting Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 systems.
The root cause is linked to Windows installations that were cloned or duplicated without proper preparation using the Sysprep tool, which can result in duplicate SIDs across devices. Microsoft has acknowledged the problem and provided guidance, noting that affected users may see specific errors such as SEC_E_NO_CREDENTIALS and warnings about machine ID mismatches in the Event Viewer. The company is working to address the issue and has published support documentation to help organizations identify and remediate impacted systems.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Recent Windows updates released in October 2025 caused login and authentication problems on some systems, particularly affecting PCs that share security identifiers. Reported impact included broken Kerberos and NTLM authentication and resulting sign-in failures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s January 2026 Windows security updates introduced regressions that disrupted enterprise endpoints, including **Remote Desktop authentication failures** affecting access to *Azure Virtual Desktop* and *Windows 365*. After installing `KB5074109` on specific Windows client builds (noted as Builds **26200.7623** and **26100.7623**), users reported repeated credential prompt/sign-in failures in the **Windows App**, preventing successful remote session establishment; Microsoft acknowledged the issue and issued an **out-of-band** update intended to restore normal Remote Desktop connectivity. Separately, Microsoft confirmed another January patch-related issue on Windows 11 23H2 where some systems with **Secure Launch** enabled may **fail to shut down, restart, or hibernate**, leaving devices running and potentially draining batteries. As a workaround, Microsoft advised forcing shutdown via the command: ```cmd shutdown /s /t 0 ``` Microsoft indicated a permanent fix would be delivered in a future update, but did not provide scope/impact metrics for affected devices.
Jun 29, 2026
Recent Windows 11 updates have introduced several authentication-related issues and changes affecting user sign-in experiences. Microsoft has acknowledged that updates released since August may cause the password sign-in icon to disappear from the lock screen, although the password field remains accessible by interacting with the invisible button. Additionally, users employing FIDO2 security keys may now be prompted to set up or enter a PIN during authentication, a change implemented to comply with WebAuthn specifications and ensure consistent user verification across registration and sign-in flows. Microsoft has not yet provided a permanent fix for the missing password icon but is working on a resolution. For the FIDO2 PIN prompt, organizations can adjust their WebAuthn configuration to discourage PIN entry if desired. These issues highlight the impact of recent Windows 11 updates on authentication workflows, requiring both end users and administrators to adapt to new behaviors and potential workarounds while Microsoft addresses the underlying problems.
Jun 29, 2026
Microsoft warned that September Windows 11 updates can prevent **Always On VPN** clients from connecting to enterprise networks when profiles automatically fall back between IKEv2 and SSTP after an initial failure. Affected devices may remain indefinitely in a “Connecting” state, repeatedly retry, or report that the specified port is already in use. Microsoft identified `KB5124012` for Windows 11 26H1 and `KB5124008` for Windows 11 25H2 and 24H2 as the originating updates, and advised organizations to configure affected VPN profiles for SSTP-only or IKEv2-only operation pending a permanent fix. Microsoft’s `KB5124010` September preview cumulative update for Windows 11 24H2 and 25H2 includes fixes for Sysmon malformed-header handling, an uninitialized-handle stop error, and erroneous Event ID 25 alerts involving `smss.exe`, but retains known issues from `KB5124008` and later updates. Those issues include possible Active Directory domain-trust loss for Credential Guard-protected machine accounts using unsupported Machine Identity Isolation configurations, plus USB Audio Class 1.0 failures or lost audio. `KB5124010` is the final preview release for Windows 11 24H2 before Home and Pro support ends October 13, 2026.
Sep 24, 2026