September 14, 2026—Hotpatch KB5129241 (OS Builds 26200.9448 and 26100.9448) Out-of-band

Symptoms

After installing the August 2026 Windows non-security preview update KB5120998 and subsequent updates, some devices might experience desktop loading issues. This issue has been primarily observed on Azure Virtual Desktop (AVD) hosts using FSLogix. This issue appears to occur more frequently with some existing user profiles.

Affected users might see a black screen after sign-in, with the desktop session failing to load automatically. In some cases, users might be unable to access their desktop until the desktop session is started manually. Application event logs might also show Windows Explorer crashes.

Workaround

Affected customers can apply one of the following workarounds to mitigate the issue:

1. Manually launch explorer.exe

   Users can temporarily mitigate this issue by opening Task Manager (Ctrl+Shift+Esc), selecting Run new task, entering explorer.exe, and selecting OK.

2. Mitigate through Known Issue Rollback (KIR)

   This issue is mitigated using Known Issue Rollback (KIR).

For enterprise-managed devices where Windows updates are managed by IT departments, IT administrators can apply the KIR by installing and configuring the Group Policy listed below.

The special Group Policy can be found in:

Computer Configuration > Administrative Templates > Group Policy name listed below

Group Policy downloads with Group Policy name

• Download for Windows 11, version 25H2 and Windows 11, version 24H2: KB5124010 260924_20021 Known Issue Rollback

Resolution

We are working on a resolution for this issue, and it will be released in a future Windows update.

Symptoms

After installing the September 8, 2026, Windows security update (KB5124008), or later updates, some Credential Guard protected machine accounts might lose their secure channel with an on-premises Active Directory (AD) domain. Users might then be unable to sign in interactively with valid domain credentials and might receive a message stating that the trust relationship between the device and the domain failed. Offline sign-in using previously cached credentials might continue to work. AD replication and AD services on the domain controllers are not affected.

This issue occurs because KB5124008 and later updates enable the Machine Identity Isolation feature. While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement. However, this feature is only supported for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above. The feature should be disabled elsewhere. Any devices previously configured to use Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers will experience this issue and will need to disable the feature.

Workaround

Important: This section contains information about modifying the registry. Before you modify the registry, back it up and make sure that you know how to restore it if a problem occurs. For more information, see How to back up and restore the registry in Windows.

To work around this issue, disable Machine Identity Isolation using the same management method that was used to enable it. Choose the applicable option below:

1. If Machine Identity Isolation was enabled by Intune policy, disable Machine Identity Isolation with Intune.

2. If Machine Identity Isolation was enabled by Group Policy, disable Machine Identity Isolation with Group Policy.

3. If Machine Identity Isolation was enabled directly in the registry, use these steps to disable it:

   • On the Windows 11, version 24H2 or 25H2 device, locate the following registry paths:

     HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation
     

     HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation
     

   • For either of these registry keys, if the value of MachineIdentityIsolation is set to 2, change it to:

     MachineIdentityIsolation = 0
     

After you disable Machine Identity Isolation, restart the device.

Then reset the secure channel using the following command:

Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

Resolution

Microsoft plans to resolve this issue in a future Windows update by temporarily preventing Machine Identity Isolation enforcement while improvements are made to the feature.

Symptoms

After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:

• The device displays an error in Device Manager: "This device cannot start (Code 10).”
• No audio output.
• Volume controls are unresponsive or remain at zero.
• Sound settings are unresponsive or unavailable.

This issue is limited to USB Audio Class 1.0 devices.

Resolution

Microsoft is working on a resolution and will update this documentation when more information is available.

Symptoms

After installing the September 2026 Windows security update KB5124008, some customers using File History, might be unable to create or update backups. File History, available through Control Panel > System and Security > File History, is used to back up files to an external drive or network location. Affected devices might incorrectly display a "Reconnect your drive" message even when a compatible backup drive is connected and functioning properly. Additionally, the "Last Backup" timestamp might not update, and previously backed up files might show "No previous version available." In some cases, Event Viewer might record application crash events referencing FileHistory.exe and KERNELBASE.dll.

Resolution

Microsoft is working on a resolution for this issue in a future Windows update and will provide more information when it is available.