Trust Relationship Failed After Windows 11 26H2?
Short answer: Windows 11 26H2 can break the secure channel between a domain-joined PC and Active Directory. It happens when Machine Identity Isolation, a Credential Guard feature, is switched on but your domain controllers are older than Windows Server 2025. Install the September 22, 2026 update (KB5124010) or any later one. If you cannot, set MachineIdentityIsolation to 0, restart, then repair the channel.
Sign-in fails with “The trust relationship between this workstation and the primary domain failed”, yet the same password works on another PC. That combination points at the machine account, not at you.
Microsoft lists this as a 26H2 issue that opened on September 16, 2026 and was resolved on September 22. If your machine still misbehaves, the sections below walk through why it happens and how to repair it.
Jump to a Section
- Why does Windows 11 26H2 say the trust relationship failed?
- Which PCs are affected?
- How do you fix it with the update?
- How do you turn off Machine Identity Isolation by hand?
- How do you repair the secure channel afterward?
- What if the fix still does not stick?
Why does Windows 11 26H2 say the trust relationship failed?
Windows 11 version 26H2 makes a domain-joined PC start honoring Machine Identity Isolation settings that already existed on it, and that feature only works against Windows Server 2025 domain controllers, according to Microsoft’s Windows 11 26H2 release health page (checked October 24, 2026). When the domain is on an older functional level, the PC loses its secure channel with Active Directory.
Microsoft describes the symptom this way: some Credential Guard protected machine accounts can no longer sign in interactively with valid domain credentials. Offline sign-in with cached credentials might keep working, and AD replication and domain controller services are not affected.
That last detail matters. The domain itself is fine. One class of PC is the problem.
Which PCs are affected?
Only domain-joined Windows 11 PCs that had Machine Identity Isolation enabled, by policy or by registry, and that connect to domain controllers below the Windows Server 2025 domain functional level are affected. A home PC that never joined a domain will not see this.
| Situation | Likely to hit the trust error? |
|---|---|
| Home PC, no domain | No |
| Domain-joined, Machine Identity Isolation never enabled | No |
| Domain-joined, enabled, domain controllers on Server 2025 functional level or higher | No, this is the supported setup |
| Domain-joined, enabled, older domain functional level, 26H2 installed before September 22 | Yes |
When I compared the release health entry with the Remote Desktop one posted a few days earlier on this site, the pattern was the same. Both come from managed-device features that behave differently once 26H2 is on. If you run a work PC, your IT team probably owns the policy that turned this on.
How do you fix it with the update?
Installing the Windows update released September 22, 2026 (KB5124010), or any update after it, fixes the trust relationship issue with no extra steps, per Microsoft. The update disables Machine Identity Isolation enforcement entirely while the feature is being improved, whatever its configuration says.
- Open Settings, then Windows Update, then select Check for updates.
- Install everything offered, including the October 13, 2026 update (KB5127648).
- Restart when prompted.
- Try signing in with a domain account again.
One catch. If the PC already refuses domain logon, you may need a local admin account or cached sign-in to reach Windows Update. Plan for that before you reboot anything.
How do you turn off Machine Identity Isolation by hand?
To switch off Machine Identity Isolation on a 26H2 PC that cannot update yet, disable it with the same method that enabled it: Intune policy, Group Policy, or the registry. Microsoft gives two registry paths and one value change.
| Registry path | Change |
|---|---|
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation |
If MachineIdentityIsolation is 2, set it to 0 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation |
If MachineIdentityIsolation is 2, set it to 0 |
Back up the registry first. Microsoft says so on the same page, and it is not boilerplate; a wrong edit under the Lsa key is painful to undo.
IT admins have a second route, Known Issue Rollback. Install the KB5124008 260915_17123 Known Issue Rollback Group Policy, set it to Disabled, and restart the device. It sits under Computer Configuration, Administrative Templates in the policy editor.
How do you repair the secure channel afterward?
After disabling the feature and restarting, repair the PC’s secure channel from an elevated PowerShell window with Test-ComputerSecureChannel -Repair -Credential (Get-Credential). Enter a domain account that is allowed to reset computer accounts when the credential prompt appears.
The command returns True when the channel is healthy. If it returns False, the account may need a reset on the domain side, which is an IT task.
| Step | What you should see |
|---|---|
| Disable Machine Identity Isolation, restart | PC boots normally; domain logon may still fail |
| Run the repair command with domain credentials | Command returns True |
| Sign out and sign in with a domain account | Domain sign-in works with no trust message |
What if the fix still does not stick?
If the trust error returns after the repair, the PC is probably getting the setting back from a policy, so look at what pushes it. Microsoft says to disable the feature using the method that enabled it; a registry edit loses to a Group Policy or Intune setting that reapplies at the next refresh.
- Check whether Intune or Group Policy sets Machine Identity Isolation for this device.
- Confirm the PC really has the September 22 update or newer: Settings, Windows Update, Update history.
- Confirm the domain functional level with your admin. Server 2025 level or higher is what the feature needs.
Here’s where people get tripped up. They fix one PC by hand and ten more break after the next reboot cycle. Fix the policy, not just the machine.
I found that the release health page lists this entry as resolved while still keeping the workarounds for anyone on an older build. So an old image or a PC that has been offline is the usual leftover case. For other 26H2 side effects, the Remote Desktop 0xC000000D guide covers the one that is still marked mitigated.
Tips
- Update first. It is the only fix that needs no registry editing.
- Keep a local admin account available before you test anything.
- Write down which policy source enabled the feature before you change it.
Warnings
- Back up the registry before editing the Lsa key.
- Do not reset the computer account in AD until the update or the setting change is in place.
- Shared or work PCs belong to IT; ask before touching policy.
FAQ
Does this affect a home Windows 11 PC?
No. It involves domain-joined PCs with Credential Guard protected machine accounts and Machine Identity Isolation, which a home PC without a domain does not use.
Can I still sign in while the trust relationship is broken?
Sometimes. Microsoft says offline sign-in with previously cached credentials might continue to work, but interactive sign-in with valid domain credentials can fail.
Will Microsoft turn Machine Identity Isolation back on?
Microsoft says the September 22, 2026 update prevents enforcement completely while improvements are made to the feature. It has not given a date for its return on the release health page.
Sources
- Microsoft: Windows 11, version 26H2 known issues and notifications
- Microsoft Learn: Credential Guard protected machine accounts
- Microsoft Learn: Test-ComputerSecureChannel
🔗 Related guides
Fact-checked based on public sources as of October 24, 2026.
