Should you install this month's Windows update right away?
· by IDE Solutions
Short answer: No, not on every machine the same day. In September 2026 a routine Windows 11 update, KB5124008, broke domain sign-in for companies still running on-premises Active Directory, plus remote desktop and VPN failures elsewhere. Microsoft shipped a workaround, not a fix. Test any update on five to ten machines for 48 hours before the rest of the office installs it.
On 9 September 2026, Microsoft released its regular monthly security update for Windows 11. Two days later, IT forums filled with the same complaint: staff typed a correct username and password and were told their laptop no longer trusted the company domain. The cause was KB5124008, a patch meant to close security holes. The effect, in some offices, was every device refusing sign-in until an administrator fixed it by hand, one machine at a time.
This kind of failure is not rare, and it is not really about this one update. It is about what happens when a business installs whatever Microsoft ships, the day it ships, on every device at once. This article covers what actually broke, why the install-everything-immediately habit is the real problem, and the low-cost process that would have limited last month's outage to a handful of machines instead of the whole office.
Quick answers
What did the September 2026 Windows update break? KB5124008 (Windows 11 24H2 and 25H2) and KB5124012 (26H1) could break the trust relationship between a domain-joined PC and an on-premises Active Directory server, plus cause Always On VPN failures. A related Windows Server update broke Remote Desktop Services on some machines.
Is it safe to install this update now? Microsoft has published a workaround and says a permanent fix is coming in a later update. If your company still runs on-premises Active Directory, test it on a small group first rather than pushing it to every machine the day it lands.
What is a pilot ring and do we need one? A pilot ring is a small group of devices, typically five to ten, that receives every update a few days before everyone else. If nothing breaks, the rest of the office follows a few days later. It costs nothing beyond the discipline to wait.
Does moving to Entra ID avoid this kind of problem? Not every failure mode, but it removes this specific one. The break was in the trust relationship with an on-premises domain controller, something a fully cloud-joined device simply does not have.
What did the September 2026 Windows update actually break?
KB5124008 is tied to a Windows security mechanism called Machine Identity Isolation, which the update set to enforcement mode. On devices still joined to an on-premises Active Directory domain, enforcement could sever the secure trust relationship between the PC and the domain controller, the digital handshake that lets Windows confirm a login is genuine. Once that trust breaks, the device shows the familiar message that the "trust relationship between this workstation and the primary domain failed", and nobody can sign in with a domain account until IT rejoins the machine manually.
The same update cycle caused separate problems: Always On VPN connections failing to establish, and on Windows Server, a related patch broke Remote Desktop Services for some organisations, according to BleepingComputer's coverage of the issue. Microsoft's own guidance, reported by Windows Report, is a temporary workaround while the company prepares a proper fix in a future release. None of this was a targeted attack or a rare edge case. It was a routine patch, tested by Microsoft, that still broke sign-in for real businesses within 48 hours of release.
Why installing every update everywhere on day one is the wrong default
Most small businesses leave Windows Update on its default setting, which means every device pulls the same patch on roughly the same day, whenever Microsoft releases it. For years that has felt like the safe choice: unpatched systems are the ones that get breached, so install everything, fast. The September outage is a reminder that this reasoning only covers half the risk. An update that has not been tested against your own environment, your domain setup, your VPN client, your line-of-business software, can break something Microsoft's own testing never touched.
The businesses that got through the September update cleanly were, almost without exception, the ones that had some form of staged rollout already in place: a small group of test devices updated first, the rest following once nothing had gone wrong. That is not a large IT department's privilege. It is a five-minute setting in Windows Update for Business, or a policy a managed cloud and endpoint service enforces on your behalf so nobody has to remember to do it by hand every month.
How a pilot ring works without hiring a dedicated IT team
Windows Update for Business supports deployment rings out of the box, and a company of 20 to 100 people does not need more than three. A pilot ring of five to ten machines, ideally including at least one from each department and one device on VPN, gets the update on day zero. Nothing else changes for 48 to 72 hours while someone watches for sign-in failures, VPN drops or application errors. If the pilot group is clean, a broad ring covering everyone else installs the update three to five days later. IT and admin devices should sit in the pilot ring permanently, since they are the machines that notice a problem first and can least afford to be locked out mid-fix.
Writing this down as an actual policy, rather than an informal habit one person remembers, is what turns it into something that survives staff turnover. A short, dated patch policy is exactly the kind of document our governance and compliance service helps SMBs produce and keep current, alongside the access and backup policies most compliance frameworks now expect in writing.
Patch immediately or stage the rollout: what changes
| Approach | What happens on a bad update | Cost to set up |
|---|---|---|
| Install on release day, everywhere | Every device fails at once, whole office locked out until each one is fixed by hand | None, but the outage cost lands on you |
| Pilot ring, then broad rollout after 3 to 5 days | 5 to 10 devices affected, fixed before anyone else installs the update | One Windows Update for Business policy, a few hours to configure once |
| Fully managed patch process | Provider catches the failure in the pilot ring and pauses the rollout, usually before you hear about it | Monthly managed service fee, no admin time required |
What this bug means if you are still running on-premises Active Directory
The September failure only hit devices with a trust relationship to an on-premises domain controller. A company that has fully moved device management to Entra ID, with no local domain controller in the loop, was not exposed to this particular fault, though it would still be exposed to whatever the next bad update breaks instead. That is not an argument for panic-migrating off Active Directory this week. It is a data point worth weighing the next time modernising identity comes up, alongside the access-control and conditional-access benefits covered in our piece on zero trust security for small business.
If you are not sure whether your organisation still depends on an on-premises domain controller for sign-in, or how exposed your current setup is to this class of failure, that is precisely what a Microsoft 365 security assessment is for: a structured look at your identity, device and patch posture rather than a guess based on how things felt the last time something broke.
What a day of locked-out logins actually costs
It is easy to treat a patch outage as an inconvenience rather than a cost, but the arithmetic is straightforward. In the tenants we manage, a full-office lockout ties up one administrator for four to six hours rejoining devices to the domain one by one, plus every affected employee sits idle until their machine is fixed. For a 25-person company at a loaded cost of roughly 35 euros an hour, half a day of that adds up to somewhere between 2,500 and 3,500 euros in lost time alone, before counting any emergency support call to fix it. A pilot ring that catches the same bug on five machines costs a fraction of that, and none of it happens during business hours the whole team needed.
Windows 10's own end of support this October adds a second reason to get patch discipline right now rather than later: more devices will be moving to Windows 11 in the coming months, which means more first exposure to exactly this kind of update risk. We covered the migration side of that deadline in what Windows 10 end of support actually costs you.
We run the patch process so it does not land on you
Our managed cloud service builds a pilot ring into every client's update schedule: a small test group first, a monitored gap of a few days, then the rest of the office, with someone watching for exactly the kind of failure September's update caused. If a patch breaks something, it breaks it on five machines we already know about, not fifty you find out about from a locked-out employee at nine in the morning.
We also document the policy itself, so it survives a change of IT provider or staff turnover instead of living in one person's head.