Windows Server 2025 DCs causing trust relationship problems on client devices

[FN-GM]

[emoji[emoji6[emoji640][emoji638]][emoji640][emoji6[emoji640][emoji638]]][emoji6[emoji640][emoji637]][emoji6[emoji640][emoji638]][emoji6[emoji640][emoji637]][emoji6[emoji640][emoji638]][emoji6[emoji640][emoji637]]]I can't believe Microsoft didn't fix these bugs before general release.

 

I can’t believe people are going straight into production with a professional that hasn’t matured.

[kevin_lane]

You need to open a ticket with ms or a consultant

 

 

You shouldn’t be making manual requests for KDC certificates

 

 

https://petri.com/trust-relationship-between-this-workstation-and-the-primary-domain-failed-error/

[psydii]

I expect since not many will have deployed this to production DCs, the AD team will be keeping an eye on DC related tickets, so open one sooner than later, and you may find you get CE (PFE) level tech engaged after a day or so.

[IanT]

Open a ticket with Microsoft to address this issue. However, it's important to note that performing an in-place upgrade of a Domain Controller is not recommended. Additionally, it's best practice to wait 6 to 12 months before rolling out or upgrading to a new operating system to ensure stability and compatibility.

[ErDT]

I have had the same issue and found so far the simplest method is to push the below script out to all machines via Senso, you would need to use an account you are happy with (this may have to be the account used to build the machine as it would be owner of the machine object, or a general admin may work, not tested that aspect) and replace the values. This will reset the securechannel from the machine to the DC. I'm not yet sure this will be a forever fix as still investigating. but you can push out to your machines and for us has rectified them at least for now.

 

Microsoft guidance on this process is here https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/active-directory-has-newer-password-value-than-client-device

 

$username = "domain\yourusername"

 

$password = "yourpassword" | ConvertTo-SecureString -AsPlainText -Force

 

$credential = [PSCredential]::new($username, $password)

 

Test-ComputerSecureChannel -Repair -Credential $credential

Edited November 20, 2024 by ErDT

[harold_dawg]

I ended up setting up a new BDC with server 2022. It was an easier fix than dealing with the issue at this point. The only service it runs is DNS so it was an easy change.

[psydii]

I ended up setting up a new BDC with server 2022. It was an easier fix than dealing with the issue at this point. The only service it runs is DNS so it was an easy change.

 

Glad to hear you found a non disruptive solution.

 

Point of pedantry though, PDCs and BDCs haven't been a thing in 25 years. PDC Emulator, yes. Other FSMO role holders, yes. Global Catalog, yes. But BDCs, no, not since NT4.

 

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-fsmo-roles

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/f96ff8ec-c660-4d6c-924f-c0dbbcac1527

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/4f99984d-2e90-48e6-b472-f5869e5b90ed

[harold_dawg]

I have been doing this since NT 4.0. I guess my lingo never upgraded.

[psydii]

Stares back in OS/2 LAN Manager.

[CHANGE2016]

Hello and thanks for your posts.

 

I have tested quite a few things. Restarting the computer helped temporarily. The command Test-ComputerSecureChannel always returned True even though the login did not work. The only thing that has helped so far was rejoining the PC to the domain. With 300 PCs, this is time-consuming. Does anyone know of a script? Thanks.

[kevin_lane]

I do have. A script that will rename devices on mass but I don’t know if that will help your situation

 

Could you try renaming a pc maybe just put an x on the end and see what happens

 

Happy to try and dig it out for you

[Michael]

I echo other comments - I only upgraded all 2016 Servers to 2019 this summer.

 

Just because the license/download is available, doesn't mean you should deploy it. Yes there are some nice features/enhancements and better security, but you're probably operating behind a hardware firewall anyway. Slow and steady wins the race!

[CHANGE2016]

Thank you, I’m no longer sure if it’s a bug in the DC Server 2025 or if the security settings are too high in connection with DC Server 2016. Rejoining the PC to the domain unfortunately didn’t bring a permanent solution. I restart the PC briefly and it works, but I can’t recognize any “certain pattern”. Thanks.

[kevin_lane]

Any chance we can see errors from the event log

 

 

 

 

Thank you, I’m no longer sure if it’s a bug in the DC Server 2025 or if the security settings are too high in connection with DC Server 2016. Rejoining the PC to the domain unfortunately didn’t bring a permanent solution. I restart the PC briefly and it works, but I can’t recognize any “certain pattern”. Thanks.

[CHANGE2016]

Hello Kevin_lane,Sure. The following error occurs on the client, it is in German, but it is noticeable that in this problem the security ID field is NullSid. When I restart the PC, it works. I have had this problem since I have a DC 2025. What event log do you need exactly to understand whats the problem? Thank you

[kevin_lane]

Unfortunately I can’t read German lol but you mentioned about, only reason I ask is that you mentioned about security settings

 

These can be controlled within group policy

 

So have you changed anything before or after you did the upgrade within group policy.

 

Or is a case up you did the in-place upgrade and then you started seeing the issues.

 

Did you open the case with Microsoft?

 

 

 

Thank you, I’m no longer sure if it’s a bug in the DC Server 2025 or if the security settings are too high in connection with DC Server 2016. Rejoining the PC to the domain unfortunately didn’t bring a permanent solution. I restart the PC briefly and it works, but I can’t recognize any “certain pattern”. Thanks.

[Kitkatninja]

...Point of pedantry though, PDCs and BDCs haven't been a thing in 25 years. PDC Emulator, yes. Other FSMO role holders, yes. Global Catalog, yes. But BDCs, no, not since NT4...

 

Apart from plug & play (from the 9x series and higher of OSes) and shadow Copy which was introduced with 2003, NT4 was an awesome OS

[psydii]

Apart from plug & play (from the 9x series and higher of OSes) and shadow Copy which was introduced with 2003, NT4 was an awesome OS

AD, Group Policy and DirectX 9 would like a word.

[Kitkatninja]

AD, Group Policy and DirectX 9 would like a word.

 

haha, they are just a fad

[Fazza]

haha, they are just a fad

 

I say bring back IPX/SPX DOS networking!

[Kitkatninja]

I say bring back IPX/SPX DOS networking!

 

Red Alert 2 and Yuri's Revenge for the win

[johndball]

My client active directory trust issues stopped when I removed conflicting GPOs and restored the "default configuration settings" in AD Admin Center and the only custom settings were password length and complexity settings. I rebuilt the password length settings, removed conflicting GPOs, and all issues below (except issue 2 and 3) have resolved.

 

TL : DR

History: In-place upgrade on three DCs in my "production lab" from 2022 to 2025. This is a domain that was originally built on 2008 R2 and either migrated or upgraded from 2008 --> 2012 --> 2016 --> 2019 --> 2022 --> and now 2025. This means GPOs implemented in 2008 (R2) were still in place.

Upgraded items: Three DCs moved to 2025. Raised forest function level. Raised domain function level. Extended schema for new LAPS recovery method. Added Windows 11 24H2 ADMX templates to Central Store.

Issue 1: File transfers via network copy or in RDP sessions from jumphosts to the PDC emulator (DomainController01) would hang and fail. Updating GPOs from jumphosts via GPMC to DomainController01 would hang but ultimately succeed. Transfers, updates, and other tasks between DomainController01 and 02/03 would work fine. Repadmin showed no issues and test files or dummy files placed in the local SYSVOL folder on each domain controller would replicate instantly.

Issue 2: Network state is in "private" mode and not domain mode. Appears to be a common problem from many server versions back, but this is the first time it bit me. Added Windows firewall rules for private connections using domain subnets.

Issue 3: Maybe cosmetic only, but forest and domain function levels show "Unknown", but I confirmed the forest and domain functions levels via PowerShell are listed as level 10.

Issue 4: Domain clients started dropping off the domain only after the upgrade to 2025 and the new LAPS recovery method was implemented. Workaround was to log in as local admin, disconnect from domain, wait about 60 seconds, rejoin to the domain, and reboot. For a production lab of about 30 machines using a MDM solution, this wasn't terrible.

Issue 5: LAPS passwords displayed in the LAPS tool were out of sync with the password on the local client and what was shown via PowerShell.

 

What I found this morning: When I opened ADAC, I received a popup stating "Active Directory Administrative Center cannot restore the custom configuration settings. The default configuration settings will be used." I clicked the OK button and went into the only custom setting I had which was a password length and complexity settings specifying 16 characters. The legacy GPO would only support 14 although in 2019 (or 2022, can't remember) another policy was added in the legacy GPO to allow more than 14. Regardless, I had conflicting password length and complexity settings and ADAC restored the default. I set this ADAC password policy back to what I had prior to the error, set the legacy GPO to not configured if set in ADAC, and ADAC was happy. I found other conflicting GPOs carried over from the 2008 R2 days including registry modifications for HTTP Auto Proxy, ciphers, etc. I went line-by-line through each of the security GPOs (three in total) and removed conflicting items or old items. One of the awesome things I started back in 2016 was adding a version number and date to the properties of each GPO and labeling each GPO with a version number in the name. I went to my notes and found the old settings.

 

Setting rollbacks today in bold font are the new settings as of this morning:

1) Microsoft Network Client: send unencrypted passwords to third-party SMB servers: disabled;

2) Microsoft network server: disconnect clients when logon hours expire: disabled;

3) Network access: allow anonymous SID/Name translation: disabled;

4) Do not allow enumeration of SAM accounts and do not allow enumeration of SAM accounts shares: enabled;

5) ADMX LAPS under Admin Templates LAPS: set all policies to not configured and configured the new LAPS under Admin Templates --> System --> LAPS.

 

It's only been a few hours, but like I mentioned above file transfers to the PDC emulator work fine and don't error out. Managing GPOs via GPMC from jumphosts work fine now. ADAC isn't erroring out. LAPS passwords checked from about a dozen machines are all in sync now.

Edited November 29, 2024 by johndball

[synaesthesia]

I say bring back IPX/SPX DOS networking!

 

LAN party incoming!

[psydii]

Welcome @johndball. That seems to me to be a promising set of steps. It's probably worth all those with older domains checking (and *testing* deployment of) these settings well ahead of deploying server 2025.

 

I wouldn't be surprised to see this getting written up into a blog or perhaps a page on learn.microsoft.com if it gets positive feedback here.

 

On versioning. In lieu of the Advance GP management tool (depreciated?) I've always insisted that GPO comment field contains the change request ticket number, and GPOs are backed up before *any* change to a common folder, and all gpos are items in our CMDB (serial number = GPO guid, name/description = the GPO's name). This level of change control/management seems to be almost impossible in InTune though

Edited November 29, 2024 by psydii

[Fazza]

LAN party incoming!

 

The good old days of lugging your 19" CRT monitor and full size gaming tower around your mates and spending 2 hours plugging it all in and getting the IPX/SPX networking working and then you break for a pizza, spend 45 with connection issues and dropouts and then spend another 2 hours packing up!!

 

 

Back on subject...

 

We wont be looking at moving to Server 2025 until at least next summer so all the issues have been ironed out.

Edited December 2, 2024 by Fazza