We Told You to Install That Update. Here's What It Broke.

Last week we told you to install Microsoft's September update. This week Microsoft published a problem with it. Here's the problem, and here's why it almost certainly isn't yours.

Last week we told you to install Microsoft's September 8 security update, and we'd say it again today. On September 16 Microsoft opened a known issue with that update. Both are true, and the second doesn't cancel the first. After installing the September update, some machines using a Windows feature called Credential Guard protected machine accounts can lose their connection to the company's Active Directory — the server that holds your user accounts and decides who can log in. In Microsoft's words, people "might then be unable to sign in interactively with valid domain credentials and might receive a message stating that the trust relationship between the device and the domain failed." Correct password. Refused anyway. The technical part — you can skip this box Microsoft Windows release health, known issue opened September 16, 2026, 14:15 PT, status Mitigated . Originating update KB5124008, released September 8, 2026, OS build 26200.9445. Affected client platforms: Windows 11 version 24H2, version 25H2 and version 26H1. Affected server platforms: none. Microsoft's workaround is to disable Machine Identity Isolation by whichever route enabled it — Intune policy, group policy, or the registry keys HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation and HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation , setting a value of 2 to 0 — then restarting and repairing the machine's secure channel with Test-ComputerSecureChannel -Repair -Credential (Get-Credential) . Some press coverage states that the update switches Machine Identity Isolation enforcement on; Microsoft's own page does not say that, and we could not confirm it, so it is not asserted here. What that actually means "The trust relationship failed" sounds like a people problem and isn't. A computer joined to a domain holds its own password, separate from yours, proving to the server it's the same machine it was yesterday. If that gets out of step, the machine is turned away however correct your password is. "Mitigated" is Microsoft's own status word: a documented workaround, not a fix shipped in an update. Why this probably isn't you Two things have to be true. Most businesses have only the first. You need on-premises Active Directory. If your logins sync to Microsoft Entra ID — the cloud half of Microsoft's login system, once called Azure Active Directory — you have a domain, and a domain is what can lose its trust relationship. Most networks we manage are built this way, so this isn't hypothetical for us. And somebody has to have switched Machine Identity Isolation on. Almost nobody has. It isn't a default, you don't arrive at it by accident, and Microsoft lists no affected server versions at all — only Windows 11 client machines. The first without the second is nothing. We're writing it up anyway for two reasons. One: we told you to install that update, so when Microsoft publishes a problem with it, you should hear that from us. Two: the reflex this produces — maybe we should hold off on patching — is the expensive one. The same update closed two flaws criminals were already using. Skipping it to avoid a fault you almost certainly can't have is a bad trade. What to do If nobody at your company has heard of Machine Identity Isolation, you're finished. Install the update. If your logins did break after September 8 and you're seeing trust-relationship errors, the important thing is what not to do: don't start resetting everyone's password. That's the wrong tree and it costs a day. Microsoft's workaround is to turn the setting off the same way it was turned on, restart, then repair the machine's secure channel — a job for your domain administrator, steps in the box above. And the general rule, which outlives this month: when a machine that worked on Friday won't let anyone in on Monday and the password is definitely right, the problem is the machine's relationship with the server, not the human's memory.