Domain-joined devices might lose their secure trust relationship with the domain

What changed

Windows 11 version 26H2 can honor an existing Machine Identity Isolation enforcement setting and break the secure channel to an on-premises Active Directory domain when domain controllers do not use Windows Server 2025 domain functional level or later.

Why it matters

Affected Credential Guard-protected devices can reject valid domain credentials with a trust-relationship error; cached offline sign-in may still work, while Active Directory replication and domain-controller services are not affected.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Install KB5124010 from September 22, 2026 or a later Windows update on affected devices; it disables Machine Identity Isolation enforcement while Microsoft improves the feature
• Identify Windows 11 24H2, 25H2, 26H1 and 26H2 devices with Machine Identity Isolation configured and verify their domain functional level
• For devices that cannot yet be updated, apply Microsoft's KIR or disable Machine Identity Isolation, restart, repair the secure channel and validate interactive domain sign-in