Windows Server 2025 DCs causing trust relationship problems on client devices

[mulbzh]

i am really lost about troubles with win 2025 and trust relationship. We don't find the solution, our computers and DC are up to date but still problems. We try also migrate some computers to last 25H2, but not better. Still kerberos errors security logs with ID 4771 : Kerberos pre-authentication failed. Command reset-computerMahcinePassword resolve temporarily , with GPO to disable password machine change it is not better. 
replication between DC is good, DNS records OK, time sync OK, ports open OK on DC

 

We test also nltest /sc_verify:CONTOSO.local on DC. On one DC we have error but if i look at this article this seems normal : https://www.dell.com/support/kbdoc/en-us/000226052/domain

we will open ticket to Microsoft...

Edited January 28 by mulbzh

[mulbzh]

For now, the Microsoft technician checked everything on domain controlers and computers and the configuration is OK. kerberos encryption is good, gpo, is good, DNS is good...

 

He doesn't find the solution for the moment

[aac]

Hi there your not alone with this. We had a 2019 and a 2025 DC and issues with group policy not applying so in the end to resolve the group policy issues we upgraded the 2019 DC to 2025 and that sorted it but to this day we are still finding some machines do not rotate machine password and therefore loose trust with the domain thus I am having to run a script on these machines monthly to rotate the passwords manually. Even if it has already lost trust with the domain it still works and saves a trip to the machine re-joining manually...

[mulbzh]

It is possible to have your script ?

We test upgrade on computers to 25H2, for the moment it seems better... for the moment no relationship error

Edited February 3 by mulbzh

[aac]

See the script below. I just added it in the software library/scripts section of SCCM then just run it on affected machines each month. Even if it says password rotation for machine failed after running on affected machine just reboot the affected machine and you will see it worked fine. I personally don't think 25h2 fixes anything but reimaging an affected machine does. Unfortunately in my scenario I just don't have time ATM to reimage the affected machines some of which have a few extra apps to install after reimaging so I will just run the script for now as I am building a new image and will reimage all machines later...

 

try {
    Write-Host "Starting machine password rotation..."
    Write-Host "Running as: $(whoami)"

    # Define credentials (plain text password converted to SecureString)
    $Username = "domain\username"   # Replace with your delegated account
    $Password = ConvertTo-SecureString "password" -AsPlainText -Force
    $Cred = New-Object System.Management.Automation.PSCredential ($Username, $Password)

    # Specify a domain controller explicitly
    $DomainController = "test.domain.internal"  # Replace with your DC name

    # Reset the machine account password using provided credentials
    Reset-ComputerMachinePassword -Server $DomainController -Credential $Cred -Verbose

    # Verify secure channel
    if (Test-ComputerSecureChannel) {
        Write-Host "Machine password successfully rotated."
        Exit 0
    }
    else {
        Write-Host "Password rotation failed: Secure channel test failed."
        Exit 1
    }
}
catch {
    Write-Host "Error rotating machine password: $($_.Exception.Message)"
    Exit 1
}

 

Edited February 3 by aac

[mulbzh]

ok thanks. So, for the moment the technician Microsoft still don't find the solution.... waiting...

[aac]

Cool, let us know please if Microsoft get anywhere with it. They must have known this issue existed for a a long while now...

[mulbzh]

6 minutes ago, aac said:

Cool, let us know please if Microsoft get anywhere with it. They must have known this issue existed for a a long while now...

yes sure because the first call with the technician, he said : 'so many troubles with windows 2025.... you should not migrate to windows 2025 !" and yes, i will post here solution from Microsoft

Edited February 4 by mulbzh

[mulbzh]

so bad Microsoft support... no solution for the moment and we said we are testing upgrade to 25H2. Microsoft technician tell : 'Ok, tell me if this resolve the troubles'. My response : we don't pay ticket for this, it is not the client who need to provide the solution.... 🙃

[mulbzh]

we upgraded 50% of computers to 25H2, we are still testing, for the moment no troubles with this version but we have to test longer to be sure

Edited February 6 by mulbzh

[tayyab12]

Nice to know my thread is still an issue a year later🤣 my god Microsoft are that clueless even their own techs are saying it. We`ve just stuck on server 2022 till MS actually find a proved solution that these issues are no longer there. Support is till 2031 so does not bother us at all.

[ITGuyNW]

21 minutes ago, tayyab12 said:

Nice to know my thread is still an issue a year later🤣 my god Microsoft are that clueless even their own techs are saying it. We`ve just stuck on server 2022 till MS actually find a proved solution that these issues are no longer there. Support is till 2031 so does not bother us at all.

The solution is.... pay us more money and use Azure\Entra instead and we are going to keep breaking server until you do so.

[mavhc]

1 hour ago, ITGuyNW said:

The solution is.... pay us more money and use Azure\Entra instead and we are going to keep breaking server until you do so.

Indeed, the sign's been on the wall for a decade now that they don't care about Windows Server

[mulbzh]

I am still testing with 25H2, still no more troubles for me....

 

Regarding Microsoft support, the technician doesn't care about me; he deliberately makes my phone ring only once, then sends an email saying: "I tried to contact you unsuccessfully to discuss the case," and he does this just before finishing his work. Then I immediately reply to his email, and the automatic response is: "I am not currently working...". 

[mulbzh]

First action from the Microsoft technician today, on my controlers, he changed :  

 

msDS-SupportedEncryptionTypes from 28 to 26 on DC accounts, in attribute editor

This change kerberos encryption type from RC4, AES 128, AES 256 to DES_CBC_MD5, AES 128, AES 256

Edited February 10 by mulbzh

[mulbzh]

few minutes after changed msDS-SupportedEncryptionType to 26, the attribute change back automatically  to 28.... What i see, it is normal because DC see Keberos with RC4 so, the DC change to 28

[mulbzh]

still no errors since we upgraded computers to 25H2

Edited February 13 by mulbzh

[mavhc]

On 11/02/2026 at 15:35, mulbzh said:

few minutes after changed msDS-SupportedEncryptionType to 26, the attribute change back automatically  to 28.... What i see, it is normal because DC see Keberos with RC4 so, the DC change to 28

GPO I assume

[mulbzh]

10 hours ago, mavhc said:

GPO I assume

No, i don't have GPO to set encryption configuration. Microsoft technician confirme, the DC can change himself this setting

[mulbzh]

Still no errors with 25h2, we are still waiting to be sure...

Edited February 16 by mulbzh

[mulbzh]

From technician, the solution is to migrate clients to 25H2 as this resolve for us. But no explanation from Microsoft technician, i don't know what happen....

[mulbzh]

no more troubles since we migrated to 25H2

[mulbzh]

after few months, still no problems since we migrated windows clients to last windows 11 version 🙂

Edited August 26 by mulbzh