Loading story…
Microsoft is investigating reports that the Windows 11 cumulative security update KB5124008 can break Active Directory domain trust relationships after affected enterprise endpoints restart. On Windows 11 24H2 and 25H2 systems, the issue reportedly disrupts the machine-account secure channel with domain controllers, preventing valid domain users from signing in; cached offline credentials may remain usable.
Administrator reports link the failures to Machine Identity Isolation operating in enforcement mode, although Microsoft has not confirmed the root cause, added the problem to its known-issues documentation, or released an official workaround. Organizations should limit deployment, preserve local administrator or LAPS recovery access, and test remediation carefully; reported options include uninstalling the update, repairing or resetting the machine-account password, or rejoining systems to the domain, while disabling Machine Identity Isolation may reduce security protections or itself affect authentication.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft released out-of-band update KB5129195 to address documented Remote Desktop Services, Hyper-V Plan9 folder-sharing, and multichannel USB audio issues. The update did not mention Active Directory domain-trust failures or Machine Identity Isolation.
Microsoft released cumulative security update KB5124008 for Windows 11 versions 25H2 and 24H2, advancing them to builds 26200.9445 and 26100.9445, respectively.
Microsoft began investigating community reports that KB5124008 breaks Active Directory domain trust on some enterprise devices. Microsoft had not confirmed the update as the cause, identified a root cause, or issued an official workaround.
Administrators associated the affected systems with Machine Identity Isolation set to enforcement mode, where machine-account secrets are isolated in Credential Guard. Reported recovery measures included disabling the setting and repairing the secure channel or rejoining devices, though disabling it reduces credential protections and can itself require a domain rejoin.
Administrators reported that installing KB5124008 and rebooting domain-joined Windows 11 25H2 devices broke their computer secure channels, preventing interactive domain logons with valid credentials. Uninstalling the update and repairing or rebuilding domain membership restored access in reported tests, while reinstalling the update reproduced the failure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft's cumulative Windows 11 security update `KB5124008` is reportedly preventing certificate-based Always On VPN tunnels from connecting on some enterprise endpoints running Windows 11 24H2 and 25H2. Administrators using Intune-deployed VPN profiles with RRAS, NPS, and certificate authentication found that uninstalling the update and rebooting restored connectivity, indicating a likely client-side regression; Microsoft had not listed the issue in its known-issues documentation. The failure creates an operational and security tradeoff for affected organizations: pausing or removing the update may restore remote access, but `KB5124008` remediates numerous vulnerabilities, including two elevation-of-privilege zero-days reported to be actively exploited. Enterprises should identify affected Always On VPN clients, test mitigation options, and monitor Microsoft for an acknowledged issue and supported fix before broadly rolling back the security release.
Sep 11, 2026
Microsoft confirmed that the Windows 11 cumulative update `KB5079473` is causing Microsoft account sign-in failures in several Microsoft applications, including **Teams, OneDrive, Edge, Excel, Word,** and **Microsoft 365 Copilot**. Affected users are shown a misleading message stating that the device is not connected to the Internet, even when connectivity is working, preventing normal sign-in activity across those services. The issue has been linked to a specific network connectivity state and appears to affect Windows 11 systems on versions **24H2** and **25H2** that use Microsoft accounts, while organizations authenticating with **Entra ID** are not impacted. Microsoft said it is developing a permanent fix and, in the meantime, recommends restarting affected PCs while they remain connected to the Internet, noting that the problem can return if a device is rebooted without an active connection.
Jun 29, 2026
Microsoft's cumulative update **KB5063878** for **Windows 11 24H2** has been linked to reports of hard drive and SSD malfunctions, including disks disappearing from the file system and possible data corruption or loss. The issue was highlighted by CSIRT.SK, which said the failures were observed after installation of the August Patch Tuesday package associated with OS build `26100.4946`. According to the advisory, damage may occur during sustained write operations involving tens of gigabytes, raising concern for systems handling heavy disk activity. CSIRT.SK said the problem appears tied to a Microsoft Defender update bundled with the release, while Microsoft had not yet published a confirmed root cause or mitigation in the referenced support material; administrators and users were urged to back up data and watch official Microsoft channels for further guidance.
Jul 24, 2026