Windows bugs and fixes September 23 2026: domain login
Chapters
TL;DR
BetaNews said on September 17, 2026 that KB5124012 broke domain sign-in on some Windows 11 PCs protected by Credential Guard. No proper domain-login fix had shipped in that report, while Notebookcheck said on September 23, 2026 that KB5124010 fixed unrelated Bluetooth, File Explorer and desktop problems, and added precision-touchpad gestures.
- BetaNews said on September 17, 2026 that valid domain credentials can fail after KB5124012.
- Microsoft’s temporary workaround, according to BleepingComputer on September 17, 2026, is to disable Machine Identity Isolation.
- Notebookcheck said on September 23, 2026 that KB5124010 fixes the 0x139 Bluetooth audio crash.
- Neowin said on September 17, 2026 that September Windows updates were also causing reported printer failures.
What broke on Windows 11?
Domain authentication broke on some Windows 11 versions after the September 2026 security updates, according to The Register on September 17, 2026. The report names Windows 11 versions 24H2, 25H2 and 26H1, with KB5124008 tied to the Machine Identity Isolation change.
The Register said on September 17, 2026 that Credential Guard-protected machine accounts could lose their Active Directory secure channel.
The resulting Windows 11 bug can reject valid domain credentials and display a trust-relationship message, while BetaNews said on September 17, 2026 that offline sign-in with cached credentials might continue working. BetaNews also said on September 17, 2026 that Active Directory replication and services on the domain controllers are not affected.
The Windows known issues explanation is specific rather than mysterious. BetaNews said on September 17, 2026 that KB5124012 and later updates make Windows honor existing or policy-provisioned Machine Identity Isolation enforcement settings. The same BetaNews report said the feature is supported only with domain controllers running at Windows Server 2025 Domain Functional Level and above. I therefore read the failure as an update exposing an incompatible security configuration, not proof that the user entered a bad password.
Has Microsoft shipped a domain-login fix?
No proper fix had shipped, according to BetaNews on September 17, 2026.
BleepingComputer said on September 17, 2026 that Microsoft was working on a future Windows update to prevent Machine Identity Isolation enforcement temporarily. The report does not name a shipped KB for that domain-login repair, and Notebookcheck’s September 23, 2026 account of KB5124010 does not identify domain authentication among its fixes.
The temporary workaround requires administrators to disable Machine Identity Isolation through the same management method that enabled it, according to BleepingComputer on September 17, 2026. The Register said on September 17, 2026 that the available methods are Intune, Group Policy or the Windows Registry, followed by a restart and secure-channel repair with Test-ComputerSecureChannel.
The workaround has a cost. Cybersecuritynews said on September 17, 2026 that Machine Identity Isolation protects Active Directory machine-account secrets through virtualization-based security. Disabling it removes that protection, and recovery may require a local administrator, according to the same Cybersecuritynews report dated September 17, 2026. My earlier KB5124008 domain-trust report covers the initial failure.
What did KB5124010 fix?
KB5124010 fixed several unrelated Windows 11 faults, according to Notebookcheck on September 23, 2026.
Notebookcheck said on September 23, 2026 that the preview update rolled out on September 22 and fixed a 0x139 blue-screen crash during Bluetooth audio streaming. The same report said KB5124010 corrects a Bluetooth toggle that could appear on while the radio was off, fixes a bug where clicking near the File Explorer address bar could wipe out typed text and improves cloud-file thumbnails.
Notebookcheck also said on September 23, 2026 that KB5124010 adds precision-touchpad edge scrolling and automatic scrolling gestures, while desktop fixes improve DIB wallpaper support, slideshow behavior across multiple desktops and previews on portrait-mode monitors. Those are shipped fixes in the preview, but Notebookcheck’s account does not say they repair the domain secure-channel failure.
Printing remains less certain. Neowin said on September 17, 2026 that September Windows updates were causing reported failures involving enterprise servers, shared drivers and remote desktop printing. Neowin tied reports to Type 3 or v3 user-mode drivers, including HP Universal Printing PCL 6, Adobe PDF Converter and Dymo LabelWriter 450 Turbo, but its September 17, 2026 report names no general shipped printer fix.
What can you do today?
Use cached offline sign-in if available, then have an administrator disable Machine Identity Isolation and repair the secure channel.
BetaNews said on September 17, 2026 that cached credentials might still permit offline sign-in, although valid interactive domain credentials can fail while the computer is connected. BleepingComputer said on September 17, 2026 that Machine Identity Isolation must be disabled on affected devices not connected to domain controllers running at Windows Server 2025 Domain Functional Level.
The Register said on September 17, 2026 that administrators should disable the feature through Intune, Group Policy or the Windows Registry, restart the computer and run Test-ComputerSecureChannel to repair the channel. The same report warned administrators to back up the registry and understand how to restore it before making registry changes.
I would not treat KB5124010 as the domain-login repair because Notebookcheck’s September 23, 2026 report lists Bluetooth, File Explorer, touchpad and desktop fixes instead. For a reported printing failure, Neowin’s September 17, 2026 account provides affected-driver evidence but no general repair, so I cannot name a supported printer fix from the dated sources.
Frequently asked questions
Which updates are linked to the domain-login failure?
BleepingComputer said on September 17, 2026 that administrators linked the failures to KB5124008 on Windows 11 24H2 and 25H2, and KB5124012 on Windows 11 26H1.
Does uninstalling Machine Identity Isolation enforcement solve the problem safely?
BleepingComputer warned on September 17, 2026 that enabling enforcement and then disabling it can break domain authentication and require the device to be unjoined and rejoined to the domain.
Does KB5124010 fix the domain trust failure?
Notebookcheck’s September 23, 2026 report lists Bluetooth, File Explorer, touchpad and desktop fixes for KB5124010, but it does not name a domain trust repair.
Has Microsoft acknowledged the authentication problem?
BleepingComputer said on September 17, 2026 that Microsoft confirmed the September 2026 security updates could trigger domain trust failures by honoring existing Machine Identity Isolation enforcement settings.