September's Windows 11 Updates Break VPN, Domain Login and Backups: What Broke and How to Work Around It
September's Windows 11 patch fixed around a thousand flaws, two of them already exploited, and left some machines unable to sign in with their domain account, unable to connect to VPN and unable to back up. Here is what Microsoft acknowledged and how to work around it.
What the September 8, 2026 Windows 11 Patch Shipped
KB5124008, KB5124012, KB5122880 and KB5122878: Which Update Each Version Gets
Every Windows version got its package in the same cycle:
- Windows 11 24H2 and 25H2: KB5124008, builds 26200.9445 and 26100.9445.
- Windows 11 26H1: KB5124012, build 28000.2954.
- Windows 11 23H2: KB5122880.
- Windows 10: KB5122878.
These are cumulative security updates, not emergency patches, and you should not attribute to one KB what another one reports.
Nearly a Thousand Vulnerabilities and Two Flaws Already Being Exploited
The figures, each with its source: ZDNET counts 995 security flaws across the September set, its highest monthly figure, and other coverage sums it up as nearly a thousand. Among them are two privilege-elevation vulnerabilities that were already being exploited in the wild. The correct phrasing is around a thousand flaws fixed, two of them privilege-elevation issues already exploited: no more than the source enumerates.
Read also
The Visible Features: a Taskbar You Can Move and Changes to Start and Search
The taskbar can be moved to any screen edge, and Start and Search got improvements. Microsoft rolls these out through gradual feature release, so they do not show up on every machine the moment you install the patch.
Regression 1: Machines That Lose Their Domain Trust
What the Machine Secure Channel Is and Why Credential Guard Protects It
A machine joined to an Active Directory domain keeps a secure channel with the domain controller: that trust relationship is what lets it authenticate users. Credential Guard protects the credentials behind that relationship by isolating their sensitive part so they are not exposed in memory.
How It Shows Up: Users Who Cannot Sign In With Domain Credentials
After installing KB5124008 or KB5124012, some machine accounts protected with Credential Guard lose that secure channel and users can no longer sign in with their corporate account. It does not affect every machine in the domain, only those with that protection enabled.
The Manual Workaround Microsoft Published
Microsoft documented the problem in the KB known issues section between September 16 and 17 and published a manual workaround tied to machine identity isolation while it prepared a permanent fix. The exact steps live in the KB itself: in a case like this, do not invent registry keys or commands.
Which Versions Are Affected and What Is Known About the Permanent Fix
It affects machines that installed KB5124008 on 24H2 and 25H2, or KB5124012 on 26H1. As for the permanent fix, the sources give no date: if it is not published, it cannot be promised.
Regression 2: VPN Stuck on Connecting
Always On VPN and Automatic IKEv2/SSTP Fallback
Always On VPN is the corporate connection that comes up by itself when the machine starts. When the profile is allowed to pick a protocol automatically between IKEv2 and SSTP, the client negotiates which one to use based on what the network answers.
The Exact Symptom: a Connection That Never Establishes
After the September updates, that automatic negotiation breaks: the connection hangs on Connecting and the machine never reaches the corporate network. Microsoft confirmed it on September 23 and 24, 2026, the freshest detail in this whole story.
The Documented Way Out: Pin One Protocol Instead of Leaving It on Auto
The workaround is to pin a single protocol in the profile instead of leaving the selection on automatic. The symptom is specific to automatic fallback: a VPN configured with a fixed protocol is not affected.
Regression 3: File History Stops Backing Up
Reconnect Your Drive With a Perfectly Working Drive
Microsoft lists in the KB5124008 KB that, after installing it, some machines cannot create or update backups with File History: the system shows Reconnect your drive even though the backup drive is connected and working.
A Last Backup Timestamp That Never Moves and No Previous Version Available
The last backup timestamp stops advancing, and files that were already backed up appear as if they had no previous version. Put another way: the backup existed and the system stopped seeing it.
The September 22 Optional Preview and the Fix That Comes Through It
The File History fix arrived in the September 22, 2026 cumulative preview update, which is optional. This is the point most often confused: the fix is not in the September security patch, it is in the preview you install separately.
Everything Else That Got Reported: Remote Desktop and Sign-Ins
There were also reports of Remote Desktop failures and of sign-in problems on machines with KB5124012. These are best presented as specialized press reports rather than official acknowledgements, except where Microsoft lists them in the KB. It was not a quiet month for anyone: in the same September, Chrome patched 42 vulnerabilities and GitLab closed a perfect 10 CVE.
What to Do About It in a Fleet of Machines
Why You Should Not Just Uninstall
Several guides recommend uninstalling the update to fix the VPN or the backups. The price is high: uninstalling also removes the month's security fixes, including the two flaws that were already being exploited. The sensible order is different.
- Apply the documented workaround for the specific symptom.
- If available, install the optional preview update that contains the fix.
- If you must roll back, do it in a pilot ring first and log which patch was removed and why.
Pilot Rings, Known Issues and Controlled Rollback
Deploying in rings means a small group of machines gets the update before everyone else, so a regression surfaces with only a few affected users. Known Issue Rollback (KIR) lets Microsoft revert a specific change without uninstalling the whole patch, but you have to check the KB to see whether it was published for that problem: do not assume it exists.
How to Read a KB Before Deploying It: the Known Issues Section
Before approving a rollout, the KB known issues section tells you what broke, on which versions and with which exit. A security update hardens conditions: the machine secure channel, protocol negotiation, access permissions to backup drives. That hardening collides with inherited configurations in the environment. It is like changing the building's lock without telling the concierge who had the old key: the new lock is better and people are still locked out.
Conclusion
September's Windows 11 patch did its job on security and still broke three things in some environments: domain trust, Always On VPN and File History backups. All three have documented ways out, and none justifies a blind uninstall. The operational lesson fits in one sentence: read the known issues before deploying, pilot in a small ring and keep a written rollback path. If you run fleets of machines, the blog publishes what changes in the software you maintain every day.
