Microsoft устраняет проблемы с входом в домен Windows 11 после сентябрьских обновлений

September 2026 updates trigger domain login failures

Microsoft acknowledged an issue preventing Windows 11 users from logging into their domain accounts after installing the September 2026 security updates. Reports indicate that the bug disrupts domain trust relationships on enterprise systems. Affected users encounter domain trust errors and credential validation failures, despite providing correct login information. IT administrators identified the Machine Identity Isolation security mechanism as the cause. This feature, when set to enforcement mode by updates KB5124012 (for Windows 11 26H1) or KB5124008 (for Windows 11 24H2/25H2), breaks domain authentication. Microsoft documentation warns that disabling Machine Identity Isolation after enabling it in enforcement mode requires unjoining and rejoining the device to the domain.

Machine Identity Isolation enforces domain authentication rules

Machine Identity Isolation is a Windows security feature designed to protect machine identities within a domain. The September 2026 updates cause Windows to honor existing or policy-configured settings for Machine Identity Isolation enforcement. However, Microsoft states this feature is only supported for environments connected to domain controllers running at Windows Server 2025 Domain Functional Level (DFL) or higher. For other environments, the feature should be disabled. Administrators must disable Machine Identity Isolation on devices not connected to Windows Server 2025 domain controllers if they previously configured it.

Disable Machine Identity Isolation to restore login access

Microsoft is developing a permanent fix to prevent Machine Identity Isolation enforcement in a future Windows update. As a temporary solution, administrators can disable the feature using the same management method employed for its activation. If Machine Identity Isolation was enabled via Intune policy, it should be disabled through Intune. Similarly, Group Policy-enabled settings require disabling via Group Policy. For devices where the feature was enabled directly in the Windows registry, administrators must navigate to HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation or HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation. If the MachineIdentityIsolation value is set to 2, it should be changed to 0. After disabling the feature and restarting the device, administrators must reset the secure channel using the command 'Test-ComputerSecureChannel -Repair -Credential (Get-Credential)'.

Источники: BleepingComputer · D-Russia