14 September 2026 | Microsoft Windows | Active Directory | IT Security
Reports of an unusual problem in traditional Active Directory environments are mounting following the release of the September 2026 security update KB5124008 for Windows 11.
Windows 11 clients that are members of an on-premises Active Directory domain are particularly affected. After the update is installed, the secure channel between the computer and the domain controller can become corrupted.
The result: the machine is still physically reachable on the network, but domain logon suddenly stops working.
What is KB5124008?
Microsoft released KB5124008 on 8 September 2026 as a security update for Windows 11 24H2 and 25H2.
The update brings Windows 11 25H2 to Build 26200.9445 and Windows 11 24H2 to Build 26100.9445. Microsoft essentially describes it as a security and quality update.
Microsoft has already documented several known issues with KB5124008, including problems with Remote Desktop Services, USB audio devices and Hyper-V-based Linux VMs. However, a problem with the Active Directory secure channel is not yet listed as a known issue in the official KB documentation.
The real problem: the secure channel to the domain
A domain-joined computer has its own computer account in Active Directory.
A secure channel exists between the computer and a domain controller. Among other things, it is required for the trust relationship between the computer and the domain.
If this channel is broken, a user may suddenly find they can no longer log on to the domain.
What makes this particularly insidious:
The username and password are still correct.
For example, Windows displays:
“The username or password is incorrect.”
In reality, however, the problem lies not with the user's password but with the computer's trust relationship with the domain.
Typical symptoms
In a reproducible case published by an administrator, the following behaviour occurred:
Windows 11 25H2
Build 26200.9445
Update KB5124008
classic Active Directory domain
Domain controller running Windows Server 2019
After the update was installed, logon initially continued to work. After a while, however, the trust relationship was broken.
The administrator was able to reproduce the issue on several devices: install the update → the problem occurs → uninstall the update → the problem disappears. After KB5124008 was reinstalled, the issue returned.
Interestingly, another administrator has also reported problems with Windows Server 2022 domain controllers. Further reports from the field even describe the problem with various domain controller versions. For now, this argues against jumping to the conclusion that the fault is confined to Windows Server 2019.
How to check for the issue
If you can still sign in to an affected computer using a local administrator account or cached domain credentials, you can check the secure channel connection using PowerShell.
Run as administrator:
Test-ComputerSecureChannel
If the secure channel is working, the command should return:
True
On an affected machine, however, it may return:
False
may appear.
You can also check using nltest:
nltest /sc_query:DOMAIN
This may, for example, produce the error
ERROR_NO_TRUST_LSA_SECRET (1786)
may occur.
These exact symptoms were documented in the Microsoft Q&A case.
Important: Do not reset the user’s password straight away
These symptoms may prompt you to reset the affected user’s password first.
In this case, however, that is usually not the right approach.
If several users on the same PC suddenly cannot log on to the domain, while, for example, they can still log on offline using cached credentials, the computer’s trust relationship should be checked first.
A typical indication is:
Test-ComputerSecureChannel
returns:
False
Possible repair attempt
As an initial repair attempt, you can re-establish the secure channel:
Test-ComputerSecureChannel -Repair
if necessary, using the credentials of a domain account with the appropriate permissions.
Alternatively, the computer account password can be reset using PowerShell.
However, caution is advised here:
In the cases reported so far, the repair has not always provided a lasting fix.
In the original Microsoft Q&A case, for example, Test-ComputerSecureChannel -Repair was not enough. The computer ultimately had to be removed from the domain and then rejoined.
Other administrators, however, report that the Repair command helped, at least temporarily. The symptoms therefore do not appear to be identical across all affected systems.
If the repair is not enough
If the Secure Channel is still broken, rejoining the computer to the domain may be necessary, although this is a more involved procedure.
In simple terms:
Enable local sign-in with an administrator account
Remove the computer from the domain
Restart the computer
Rejoin the computer to the domain
Restart again
Test domain sign-in
In the documented case in which the issue was reproduced, this exact procedure was needed to resolve it permanently.
Should KB5124008 be held back for now?
It is worth drawing a distinction here.
KB5124008 is a security update and should not simply be uninstalled across the board in all environments.
At the same time, administrators running traditional Active Directory environments should currently keep a particularly close eye on the installation.
KB5124008 delivers important security improvements from Microsoft. The update is also distributed via Windows Update, Windows Update for Business and WSUS.
A controlled rollout is therefore recommended for production environments:
Test group → monitor → larger group → full rollout
and not necessarily:
Update all clients at the same time.
A local administrator account or a working recovery option should also be available, particularly on devices that users rely on to log in each day.
Our current recommendations
For organisations using traditional Active Directory, we currently recommend the following:
1. Check the affected Windows 11 versions
On a client:
winver
or:
Get-ComputerInfo | Select WindowsProductName, WindowsDisplayVersion, OsBuildNumber
2. Check whether KB5124008 has been installed
Get-HotFix -Id KB5124008
3. If there are logon problems, check the secure channel
Test-ComputerSecureChannel
4. If the result is False, try a repair first
Test-ComputerSecureChannel -Repair
5. If problems recur, document the cause
In particular, the following information should be recorded:
Windows version
OS build
installed KB updates
domain controller version
When the issue occurred
result of Test-ComputerSecureChannel
result of nltest /sc_query
events on the client and domain controller
This makes it much easier to determine whether there is actually a link to the update.
No definitive cause confirmed yet
An important caveat is needed here:
The link between KB5124008 and broken domain secure channels is currently being reported by administrators as reproducible, but as things stand it is not listed as a corresponding known issue in Microsoft's official KB documentation.
The original Microsoft Q&A report describes a reproducible scenario involving Windows 11 25H2 and Windows Server 2019 domain controllers. Other administrators are reporting similar problems with systems including Windows Server 2022.
That is one more reason not to rush to claim that KB5124008 is definitely the cause of every current "trust relationship" error.
Other causes, such as DNS issues, clock differences, problems with the computer account or network/VPN components, still need to be ruled out.
Conclusion
KB5124008 currently warrants particularly close monitoring in Active Directory environments.
If several users of a Windows 11 PC suddenly find they can no longer sign in to the domain after the September update, despite entering the correct credentials, it is worth checking the computer's trust relationship with the domain.
The key test to run first is:
Test-ComputerSecureChannel
If the command returns False, there is very likely a problem with the computer's secure channel to the domain.
Since the reports so far show that a simple repair does not provide a lasting fix on every system, affected devices should be documented carefully, and user accounts or passwords should not be changed hastily.
This article is current as of 14 September 2026.
We are monitoring developments relating to KB5124008 and will update this article as soon as Microsoft releases an official statement or a fix for the issue.