What is happening
Microsoft released KB5124008 as part of the September 2026 Patch Tuesday cycle. It brings Windows 11 25H2 devices to OS Build 26200.9445. The update itself patches real security vulnerabilities, which is why it was pushed out — but it has introduced a serious side effect for organisations running traditional on-premises Active Directory environments.
The issue is with something called the machine secure channel. Every computer that is joined to a Windows domain maintains a secure, encrypted channel to a domain controller. This channel is how the computer proves its identity to the domain and how logon requests are validated. When this channel breaks, the computer can no longer communicate with Active Directory — and domain logons stop working.
KB5124008 introduced stricter Netlogon secure channel negotiation settings. In environments where the domain controllers are running Windows Server 2019, or some configurations of Windows Server 2022, those DCs do not support the new negotiation level the updated client is requesting. The result: the channel fails to establish, and logons fail.
Who is affected
Not every organisation will experience this. The issue is specific to a combination of factors:
| Factor | Affected? |
|---|---|
| Windows 11 25H2 devices with KB5124008 installed | ✅ Yes — this is the trigger |
| Domain-joined to Windows Server 2019 DCs | ✅ Yes — confirmed affected |
| Domain-joined to some Windows Server 2022 DCs | ✅ Yes — affected in some configurations |
| Domain-joined to Windows Server 2025 DCs | ❌ No — not affected |
| Entra ID joined only (no on-prem AD) | ❌ No — not affected |
| Windows 11 24H2 devices | ❌ No — not affected by this specific issue |
| Workgroup devices (not domain-joined) | ❌ No — not affected |
If your organisation has already upgraded some devices to Windows 11 25H2 and your domain controllers are running Windows Server 2019, you are likely to see this. Organisations that have already moved to Windows Server 2025 DCs or who are purely cloud-joined (Entra ID only) will not be affected.
How to tell if your devices are affected
The most visible symptom is that users on affected devices cannot log in interactively. They receive an error along the lines of “The user name or password is incorrect” — even when the credentials are correct. The machine itself is fine; it is the communication with the domain that has broken.
On the domain controller side, affected logon attempts generate Event ID 4625 in the Security event log, with a Failure Reason of Status 0xC000006D (unknown username or bad password from the DC’s perspective).
You can also run a quick check directly on any affected device using PowerShell to test whether the secure channel is healthy:
If Test-ComputerSecureChannel returns False or nltest returns ERROR_NO_TRUST_LSA_SECRET, the machine secure channel is broken and the device is affected.
What you can do now
Microsoft has not yet released a fix in a Windows Update. Until a patched cumulative update is available, there are two workarounds. The first is quicker and less disruptive. The second is a last resort if the first does not work.
Workaround 1 — Registry change and repair (recommended, no rejoin required):
This changes a registry setting that controls how strictly the machine identity isolation behaviour is enforced during Netlogon negotiation, then uses a built-in PowerShell command to re-establish the secure channel without needing to leave and rejoin the domain.
A restart is not required for Workaround 1. Once Test-ComputerSecureChannel returns True, the device is reconnected to the domain and logons will work again.
Workaround 2 — Full domain rejoin (last resort):
If Workaround 1 does not resolve the issue, the device can be removed from the domain, joined to a workgroup, restarted, and then re-joined to the domain. This is more disruptive and will require a local admin account to sign in during the transition. It should work in all cases but is time-consuming if you have many affected devices.
Test-ComputerSecureChannel -Repair can both be run via a PowerShell script deployed through Intune as a Platform Script (Windows, run as System). This avoids needing to touch each device individually.Microsoft’s response
Microsoft has acknowledged this as a known issue affecting Windows 11 25H2 (OS Build 26200.9445) in environments with Windows Server 2019 and some Windows Server 2022 domain controllers. The issue is tracked on the Windows 11 25H2 Health Dashboard on Microsoft Learn, and Microsoft has stated that a fix is in development.
Until that fix arrives in a future cumulative update, the recommendation is to pause deployment of KB5124008 to Windows 11 25H2 devices in environments with Server 2019 or Server 2022 domain controllers. Devices that have already received it and are experiencing logon failures should use the workarounds above.
For further background, Microsoft’s documentation covers this in detail:
- KB5124008 known issue — Microsoft community thread (Microsoft Learn)
- Windows 11 25H2 release health — known issues dashboard
- Test-ComputerSecureChannel cmdlet documentation (Microsoft Learn)
We will update this post when Microsoft releases a patched cumulative update that resolves the issue.