Windows 11 Domain Trust Error After September 2026 Updates
Windows 11 Domain Trust Error After September 2026 Updates
Identify and fix it with Microsoft Intune
After installing the September 2026 Windows 11 security updates, some domain-joined devices may lose their secure trust relationship with an on-premises Active Directory domain.
Users may see:
The trust relationship between this workstation and the primary domain failed.
The user's credentials may be correct. The problem can instead be the computer's Secure Channel with Active Directory.
Microsoft identified Machine Identity Isolation as the cause of this issue in affected environments. The September 8, 2026 security update causes Windows to begin honoring existing or policy-provisioned Machine Identity Isolation enforcement. Microsoft states that the feature is supported only when connected to domain controllers running at Windows Server 2025 Domain Functional Level (DFL) or later. Devices configured for Machine Identity Isolation outside those supported environments can experience Secure Channel failures.
This guide shows how to identify the configuration with Microsoft Intune, verify the Secure Channel, and remediate affected devices.
1Inventory Machine Identity Isolation with Intune
Instead of checking devices individually, use Intune Registry Inventory to identify where Machine Identity Isolation is configured.
In the Microsoft Intune admin center, go to:
Devices → Windows → Device Inventory → Registry
Add the following registry entries.
Registry Entry 1
Registry key path:
SYSTEM\CurrentControlSet\Control\LsaValue name:
MachineIdentityIsolationRegistry Entry 2
Registry key path:
SOFTWARE\Policies\Microsoft\Windows\DeviceGuardValue name:
MachineIdentityIsolationDo not include HKLM:\ in the path. Intune already uses the HKLM hive for Registry Inventory.
The second location is particularly important because Microsoft documents it as the Group Policy mapping for Machine Identity Isolation Configuration.
2Understand the Registry Values
Machine Identity Isolation uses these values:
| Value | Meaning |
|---|---|
0 | Disabled |
1 | Enabled – Audit mode |
2 | Enabled – Enforcement mode |
Microsoft documents these values through the DeviceGuard Policy CSP.
For this September 2026 issue, the important configuration to investigate is enforcement mode (2).
However, finding MachineIdentityIsolation = 2 does not by itself prove that the Secure Channel is broken.
3Verify the Secure Channel
On an affected device, run PowerShell:
Test-ComputerSecureChannelIf the result is True, the computer's Secure Channel is currently healthy.
If the result is False, the Secure Channel is broken and should be investigated.
4Identify How Machine Identity Isolation Was Configured
Before making changes, determine which management method is controlling the setting. Common sources are:
- Microsoft Intune
- Group Policy
- Direct Registry configuration
For Intune, review your Device Guard-related configuration profiles. The Microsoft Policy CSP setting is:
./Device/Vendor/MSFT/Policy/Config/DeviceGuard/MachineIdentityIsolationThis step is important because Microsoft recommends disabling Machine Identity Isolation using the same management method that was used to enable it.
5If Intune Configured the Setting
- Identify the configuration profile assigning the setting.
- Set Machine Identity Isolation to Disabled.
- Synchronize the device.
- Confirm that the policy has been applied.
- Restart the device.
Do not manually change the Registry while an Intune policy is still enforcing the setting.
6If Group Policy Configured the Setting
- Identify the responsible GPO.
- Disable Machine Identity Isolation in the GPO.
- Run:
gpupdate /force - Confirm that the configuration has changed.
- Restart the device.
Use Group Policy to make the change rather than modifying the Registry manually.
7If the Registry Was Configured Directly
If no Intune or Group Policy configuration exists and the setting was configured directly in the Registry, Microsoft documents these locations:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation
HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolationIf MachineIdentityIsolation is set to 2, Microsoft's workaround is to change it to 0.
Back up the Registry before making manual changes.
8Restart the Device
After disabling Machine Identity Isolation:
Restart-ComputerA restart is required before continuing with the Secure Channel repair.
9Repair the Secure Channel
After the restart, run:
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)Enter appropriate domain credentials when prompted. Then verify the Secure Channel:
Test-ComputerSecureChannelExpected result: True
Microsoft documents this command as part of the workaround for the affected devices.
Important Consideration
Machine Identity Isolation is a security feature. Do not disable it across the entire organization simply because the setting exists.
Instead:
- Inventory first
- Identify the configuration source
- Verify the Secure Channel
- Target affected devices
- Disable the feature using the original management method
- Repair and verify the Secure Channel
If your environment is not running domain controllers at Windows Server 2025 DFL or later, Microsoft states that Machine Identity Isolation is not supported in that environment and should be disabled.
Recommended Enterprise Workflow
↓
Identify Machine Identity Isolation
↓
Identify Configuration Source
↓
Verify Secure Channel
↓
Target Affected Devices
↓
Disable Machine Identity Isolation
↓
Restart Device
↓
Repair Secure Channel
↓
Verify Secure Channel = True
Conclusion
Inventory first. Identify the configuration source. Remediate only affected devices.
By combining Intune Registry Inventory with Secure Channel validation, administrators can identify affected Windows 11 devices centrally and remediate the September 2026 domain trust issue in a controlled and scalable way.
Kommentarer
Skicka en kommentar