Does KB5124008 Break the Domain Secure Channel on Windows 11?
Asked by
MellowPine47
Has anyone else seen domain trust or secure-channel problems after installing KB5124008 on a Windows 11 25H2 client? In testing with Windows Server 2019 domain controllers that had not yet been patched, the client accepted domain credentials after reboot, but Test-ComputerSecureChannel returned false and reported that the secure channel was broken. At the same time, nltest /sc_query:domain showed a successful connection to the domain controller. Running Test-ComputerSecureChannel -Repair restored the channel and subsequent checks returned True. I'm trying to determine whether this is a real update-related issue or an inconsistent diagnostic result before deploying the update more broadly.
Answers
I saw the same behavior on a Windows 11 25H2 machine after installing KB5124008. The client could still authenticate against our unpatched Windows Server 2019 domain controllers, and nltest /sc_query:domain reported NERR_Success, but Test-ComputerSecureChannel returned false. Running Test-ComputerSecureChannel -Repair fixed it immediately, so I’m testing additional clients to see whether the issue is widespread or just a misleading check.
Reply to this answer
The different results suggest the Netlogon connection was still working while PowerShell detected a problem with the computer account’s secure channel. I’d compare the client and domain-controller patch levels, then monitor more machines before concluding that the update consistently breaks trust. A repair command can restore the channel, but it’s worth checking event logs and validating whether the problem returns after another reboot.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions