Microsoft patch reportedly causes trust issues for domain-joined Windows PCs

The recent Microsoft patch has introduced trust issues for domain-joined Windows PCs, particularly affecting those utilizing Credential Guard. Users may find themselves unable to log in with valid domain credentials due to changes in Machine Identity Isolation policies. This is especially problematic for environments that haven't upgraded their domain controllers to Windows Server 2025.

Organizations running Windows 11 versions 24H2, 25H2, and 26H1 are experiencing issues because the new enforcement of Machine Identity Isolation is only compatible with Windows Server 2025 Domain Functional Level. This means that unless organizations are prepared to upgrade their servers, they will face disruptions in user access and authentication processes.

Microsoft has acknowledged the problem and provided a workaround, but this requires technical knowledge and careful handling of system settings. Administrators must disable Machine Identity Isolation through Intune, Group Policy, or the Windows Registry, which necessitates backing up the registry and understanding restoration processes. The complexity involved can lead to additional downtime and administrative overhead.

The longer-term solution from Microsoft indicates that they plan to temporarily prevent enforcement of Machine Identity Isolation in future updates. However, this does not alleviate immediate issues for affected users and administrators, emphasizing the need for careful change management when applying updates in enterprise environments.

This situation highlights the critical nature of ensuring that all components of an IT infrastructure, including servers and client machines, are on compatible versions to avoid authentication issues. As organizations navigate these changes, they need to be vigilant in monitoring their systems and preparing for potential disruptions.