CyberNew CyberNew
Threat Intelligence & APT BleepingComputer 1 month ago

Windows 11 KB5124008 update breaks domain trust for some users

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials. Administrators report on Reddit and Microsoft's Q&A forums that affected computers lose their secure channel with Active Directory after the Windows 11 update is installed and devices..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Windows 11

Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, preventing users from logging in with valid domain credentials.

Administrators report on Reddit and Microsoft's Q&A forums that affected computers lose their secure channel with Active Directory after the Windows 11 update is installed and devices reboot.

Last week, Microsoft confirmed to BleepingComputer that it is aware of the reports and is investigating.

"Microsoft is aware of these reports and is investigating. We will share guidance as it becomes available," Microsoft told BleepingComputer.

While Microsoft has not confirmed the root cause, reports indicate that the failures are linked to the Windows Machine Identity Isolation security feature, especially when it is enabled in audit or enforcement mode.

Domain trust breaks after installing KB5124008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"MachineIdentityIsolation"
Test-ComputerSecureChannel -Repair -Credential(Get-Credential)
Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →