A user enters valid domain credentials after a Windows security update, yet the PC reports a broken trust relationship with its domain. A helpdesk might suspect the password, the account or a domain controller. The first question should be whether this is a client-side secure-channel failure.

Microsoft confirms that September's updates can cause this failure on some Credential Guard protected Windows 11 devices joined to on-premises Active Directory. Its affected list covers versions 24H2, 25H2 and 26H1. As of 28 September, Microsoft marks the issue mitigated, not resolved. It says AD replication and domain-controller services are unaffected.

For administrators, that distinction changes the response. A device that opens with cached credentials has not demonstrated that it can authenticate online. Resetting a user's password or making a broad change to AD could consume the recovery window without addressing the failing client. Keep the investigation tied to the device, its policy and its domain dependency.

Microsoft says the update makes Windows honour an existing Machine Identity Isolation setting; it does not switch on enforcement by itself. This is why two PCs on the same update can have different outcomes. A patch inventory alone cannot establish which policy was applied, when it reached the device or whether it was later replaced.

Machine Identity Isolation is meant to move a computer's domain account secret into Credential Guard's isolated environment. That limits exposure of the secret to code running in the normal Windows environment. It is a meaningful protection for machine identities, not a cosmetic policy switch.