KB5124012: Windows 11 version 26H1 Security Update (September 2026)

1. Devices might experience a black screen or desktop loading issues after sign-in

Symptoms:

After installing the August 2026 Windows non-security preview update KB5120996 and subsequent updates, some devices might experience desktop loading issues. This issue has been primarily observed on Azure Virtual Desktop (AVD) hosts using FSLogix. This issue appears to occur more frequently with some existing user profiles.

Affected users might see a black screen after sign-in, with the desktop session failing to load automatically. In some cases, users might be unable to access their desktop until the desktop session is started manually. Application event logs might also show Windows Explorer crashes.

Resolution

This issue is resolved in Windows updates released on and after October 13, 2026 such as KB5127646 . We recommend you install the latest Windows update for your device as it contains important improvements and issue resolutions, including this one.

2. Domain-joined devices might lose their secure trust relationship with the domain

Symptoms

After installing the September 8, 2026, Windows security update KB5124012 , or later updates, some Credential Guard protected machine accounts might lose their secure channel with an on-premises Active Directory (AD) domain. Users might then be unable to sign in interactively with valid domain credentials and might receive a message stating that the trust relationship between the device and the domain failed. Offline sign-in using previously cached credentials might continue to work. AD replication and AD services on the domain controllers are not affected.

This issue occurs because KB5124012 and later updates enable the Machine Identity Isolation feature. While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement. However, this feature is only supported for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above. The feature should be disabled elsewhere. Any devices previously configured to use Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers will experience this issue and will need to disable the feature.

Resolution

This issue is addressed by KB5124010 . This update prevents Machine Identity Isolation (MII) enforcement by disabling it completely while improvements are made to the feature. MII enforcement will be prevented regardless of the MII configuration.

USB ...