Windows 11 KB5124008 Breaks Active Directory Domain Trust

Microsoft is investigating reports that the Windows 11 cumulative security update KB5124008 can break Active Directory domain trust relationships after affected enterprise endpoints restart. On Windows 11 24H2 and 25H2 systems, the issue reportedly disrupts the machine-account secure channel with domain controllers, preventing valid domain users from signing in; cached offline credentials may remain usable.

Administrator reports link the failures to Machine Identity Isolation operating in enforcement mode, although Microsoft has not confirmed the root cause, added the problem to its known-issues documentation, or released an official workaround. Organizations should limit deployment, preserve local administrator or LAPS recovery access, and test remediation carefully; reported options include uninstalling the update, repairing or resetting the machine-account password, or rejoining systems to the domain, while disabling Machine Identity Isolation may reduce security protections or itself affect authentication.