Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating reports that the September Windows 11 security update KB5124008 breaks domain trust on enterprise systems. Users cannot sign in with valid Active Directory credentials; the issue is tied to the Machine Identity Isolation feature in audit or enforcement mode.

• Failure affects Windows 11 25H2 after KB5124008 and a reboot
• One admin saw 11 of ~256 devices lose domain trust
• Cause: Machine Identity Isolation in mode '2' (enforcement)
• Workaround: disable the feature and restore the channel via PowerShell