KEH-TECH

September 2026 Patch Tuesday: RDS Failures, Broken Domain Trust, and What the Emergency Updates Actually Fix

Status as of September 17, 2026. This is a developing story and we will update this post as Microsoft publishes new guidance.

The September 8, 2026 Patch Tuesday updates shipped with two problems that matter to anyone running a Windows domain. The first breaks Remote Desktop Services on servers. The second breaks the domain trust relationship on Windows 11 endpoints. Microsoft has released out-of-band updates, but they only fix the first problem. Here is what we know and what to do about each one.

The short version

Issue Affected Out-of-band fix? What to do now
RDS and RDP instability Windows Server 2012 through 2025, plus Windows 10 and 11 Yes, released September 14. It resolves the issue. Install the out-of-band update for your OS. Use the Known Issue Rollback where no out-of-band update exists.
Domain trust failures Windows 11 24H2 and 25H2 with Machine Identity Isolation in audit or enforcement mode No. KB5129195 does not fix it. Check the Machine Identity Isolation setting before you deploy. Disable it and repair the secure channel on broken machines.

1. RDS and Terminal Services problems

What is happening

Microsoft confirmed that after the September updates, Remote Desktop Services can become unstable. In Microsoft’s words, this results in “RDP connections failing after several minutes, sign-in issues, or servers hanging at ‘Please wait for the Remote Desktop Configuration.’” Admins have also reported MMC consoles, the RD Licensing Diagnoser, File Explorer and the Windows Update settings page spinning forever on affected servers.

The nasty part is the delay. Servers usually run fine for a few hours after the update and reboot, so the patch looks clean in testing and then session hosts start failing in production. Restarting the server clears it for a while, and then it comes back.

Which updates cause it

Operating system September update Out-of-band fix
Windows Server 2025 KB5122871 KB5129235
Windows Server 2022 KB5122882 KB5129237
Windows Server 2019 KB5122876 KB5129238
Windows Server 2016 KB5123099 None reported yet. Use the KIR.
Windows Server 2012 R2 KB5123066 None reported yet. Use the KIR.
Windows Server 2012 KB5123065 None reported yet. Use the KIR.
Windows 11 26H1 KB5124012 KB5129194
Windows 11 24H2 and 25H2 KB5124008 KB5129195
Windows 11 23H2 KB5122880 None reported yet
Windows 10 21H2 and 22H2 KB5122878 KB5129236

Recommended fix: install the out-of-band update

Microsoft released emergency updates on September 14, and they do resolve the RDS instability. They also fix a Hyper-V bug that broke Plan9 folder sharing with Linux VMs, and they add a fix for CVE-2026-62721, an elevation of privilege flaw in the Windows User-Mode Power Service. That last item means the out-of-band update is worth installing even on machines that never showed the RDS problem.

One thing will catch people out. The client updates arrive through Windows Update, but the Server 2019, 2022 and 2025 updates are only on the Microsoft Update Catalog. They will not show up on their own. If you patch with WSUS or Configuration Manager, you need to import them from the Catalog by hand, or download the MSU and install it directly.

If you cannot install the out-of-band update yet

  • Known Issue Rollback (preferred). Microsoft published KIR Group Policy packages for each affected OS. Download the MSI for your OS version, install it on a management workstation or domain controller, and copy the ADMX and ADML files to your central store if you use one. Create a GPO linked to the OU holding your RDS servers. The setting appears under Computer Configuration > Administrative Templates > [KB number] Known Issue Rollback. Set it to Disabled, which is what turns the faulty change off. Run gpupdate /force and restart the servers. This keeps the September security fixes in place.
  • Restart the server. This buys you a few hours and nothing more.
  • Uninstall the September update (last resort). It works, but you give up every security fix in the release. We would only do this on a server where the KIR and the out-of-band update have both failed.

A small number of admins have reported that the KIR alone did not clear the problem on Server 2019 and 2022. If you see that, go straight to the out-of-band update.

2. Endpoints and domain trust problems

What is happening

After installing KB5124008 on Windows 11 24H2 or 25H2 and rebooting, some domain-joined machines lose their secure channel to Active Directory. Users see the familiar “The trust relationship between this workstation and the primary domain failed” message and cannot sign in with valid domain credentials. Cached credentials still work while the machine is offline, which can hide the problem on laptops until they return to the network.

The cause

The reports point to Machine Identity Isolation. This is a Credential Guard feature that protects the computer account’s secret with virtualization-based security. In enforcement mode, Windows moves the machine secret into Credential Guard and deletes the copy that LSA normally holds.

KB5124008 appears to make Windows start honouring Machine Identity Isolation settings that were already present or pushed by policy. Affected admins found the value set to 2 (enforcement) after the update. The feature is reportedly only supported when the domain is at the Windows Server 2025 functional level. Most of us are not there yet, and the failures have been reproduced against Server 2019 and Server 2022 domain controllers. The result is a machine that can no longer prove its identity to the domain.

Is there an out-of-band fix?

No. KB5129195 fixes RDS, Hyper-V and part of the USB audio problem. Several sources have confirmed it does not fix domain trust, and Microsoft’s page for that update does not mention it. Microsoft says it is aware of the reports and is investigating. According to reports, the plan is a future update that temporarily stops Machine Identity Isolation from being enforced while the feature is reworked. There is no date yet.

Check your exposure before you deploy

Look at this registry value on your Windows 11 24H2 and 25H2 machines:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
MachineIdentityIsolation (DWORD)
0 = disabled, 1 = audit, 2 = enforcement

The matching policy is under Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security > Machine Identity Isolation Configuration. Check your security baselines too, since a baseline may have set it without anyone noticing.

If the value is 1 or 2, that machine is at risk. Microsoft’s current guidance is to turn the feature off using the same mechanism that turned it on, so fix the GPO or Intune policy rather than fighting it with a registry edit. Do this before KB5124008 lands. It is also sensible to hold broad deployment of KB5124008 to a pilot ring until you have checked.

Repairing a machine that has already lost trust

Sign in with a local administrator account. This is a good week to confirm that LAPS is working. Then, from an elevated PowerShell prompt:

# 1. Confirm the diagnosis. False means the secure channel is broken.
Test-ComputerSecureChannel
nltest /sc_query:yourdomain.example

# 2. Disable Machine Identity Isolation, then reboot
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name MachineIdentityIsolation -Value 0 -Type DWord
Restart-Computer

# 3. After the reboot, repair the secure channel
Test-ComputerSecureChannel -Repair -Server DC01 -Credential (Get-Credential)

# 4. Verify
nltest /sc_verify:yourdomain.example

On a broken machine, nltest /sc_query typically returns error 1786, ERROR_NO_TRUST_LSA_SECRET. If the repair fails, Reset-ComputerMachinePassword -Server DC01 -Credential (Get-Credential) is the next step, and a full unjoin and rejoin is the fallback after that.

A word of caution. Treat the registry change as a community-tested mitigation and not a finished vendor fix. There are reports that switching the value from audit or enforcement to disabled can itself break trust on a machine that was still working, because the secret has already been moved. Test on a small group first, and make sure you have local admin access before you touch anything.

Uninstalling KB5124008 also restores normal behaviour, but as with the server updates, it removes the month’s security fixes and should be the last option.

Still broken after the out-of-band updates

  • Domain trust failures on Windows 11 24H2 and 25H2, as described above.
  • Some USB Audio Class 1.0 devices still fail with “This device cannot start (Code 10).” Microsoft is working on it.
  • Reports of AMD GPU errors on Windows 11 that KB5129195 does not address.

What we would do this week

  1. Import the Server out-of-band updates from the Catalog and get them onto your RDS session hosts, brokers and gateways first.
  2. Deploy the KIR to Server 2016 and older, where there is no out-of-band update yet.
  3. Audit MachineIdentityIsolation across your Windows 11 fleet before KB5124008 or KB5129195 goes any wider.
  4. Confirm you can get a local admin password for any endpoint, so a trust failure is a ten minute fix and not a reimage.

Seeing something different in your environment? Tell us in the forum. Real-world reports help everyone.

Sources