Windows Server 2025 DCs causing trust relationship problems on client devices

[ErDT]

Hi Stephen

 

Code executed is below along with screenshot of the scheduled task. However i would have expected your manual reset to have rectified the issue so i am not confident that this would rectify your issue as i suspect you have a secondary problem also blocking the adapter being picked up as domain.

 

-executionpolicy bypass -command "$NetworkCategory = (Get-NetConnectionProfile).NetworkCategory; if ($NetworkCategory -notmatch 'DomainAuthenticated') { Get-NetAdapter | Restart-NetAdapter }"

 

Thank you for that - are you able to share that script at all? I've tried manually disconnecting/reconnecting, restarting various services, but just cannot get it to recognise as domain profile... which may be causing that 3rd issue anyway potentially!

[Daradon]

Hello.

I fixed the trust lost with updating all devices to win 11 24h2. But one error is still going on. Every day im getting the Error ID 7 KDC in DCs log( Security Account Manager unexpectedly failed to make a KDC request. The error is contained in the data field. The account name was "" and the lookup type was "0x100 or 0x108".

Anyone know what this mean? I thought it has something to do with the trust lost. but no. I saw another ms forum about this with 2025 dcs.

[miljw002]

Hello.

I fixed the trust lost with updating all devices to win 11 24h2. But one error is still going on. Every day im getting the Error ID 7 KDC in DCs log( SecurityAccountManagerunexpectedlyfailedtomakeaKDCrequest.Theerroriscontainedinthedatafield.Theaccountnamewas""andthelookuptypewas"0x100 or 0x108".

Anyone know what this mean? I thought it has something to do with the trust lost. but no. I saw another ms forum about this with 2025 dcs.

 

I've been getting the same error (below) since upgrading my DC's to 2025 as well.

 

system: error - 2025/02/19 21:00:06 - KDC (7) - n/a

"The Security Account Manager failed a KDC request in an unexpected way. The error

is in the data field. The account name was ? and lookup type 0x108.

Which is a bit unhelpful as it's supposed to include the computer name and not just a "?".

 

I've got a mix of Windows Server 2025, Windows 10, Redhat 9, ESXi 7, UnRAID as Domain joined, so could be any number of them.

 

This is looking like one of the symptoms of how Kerberos is broken on Windows Server 2025.

 

I was running Windows Server 2025 as a member for months before upgrading, and had none of the issues being described here. They all started when I upgraded the DCs. The Feb update doesn't appear to have helped.

 

I'm just hoping that the March or April one will fix Kerberos in Server 2025.

 

James

[Daradon]

thank you for your feedback @miljw002

That calms me down.Then we'll wait and see.Everything works so far!

[iamwinauser]

Did anyone work out if the issue is resolved? It's gone a little quite here.

 

I still have "Disable machine account password changes" enabled, so was wondering if it's safe to enable them again.

 

After disabling the machine password, exactly one month later, all system logins started taking 2-3 minutes. I have tried all available solutions online, but none have worked.

[ErDT]

So the site i focused on over the break is as per below

2x DC's on 2025 with Feb update, majority of devices on 24H2, some on 23H2 (these continue to receive the script to manually reset their passwords) a few on W10 22H2 (these have always been fine), iMacs (these have always been fine)

 

I disabled the script to manually reset their machine passwords during the break for all devices barring the ones on 23H2, the majority of devices haven't reset their passwords yet. But i have seen 10-20 of the machines on 24H2 correctly reset their passwords and am not aware of anyone coming to the office with an issue. So if you are having this issue i would recommend pushing your devices up to 24H2, obviously i wont know its fully sorted until more than 30 days after half term so the majority of the devices attempt to reset their passwords through the normal mechanism, but as I've seen a good handful do it I'm fairly confident it sorts it "Touches Wood".

[iamwinauser]

This morning, I asked a few users not to log into their systems. I then deployed Reset-ComputerMachinePassword using PDQ Deploy, restarted the systems, and boom! Those users were able to log in within 2-3 seconds.

[5nowman]

Hi, sorry to ask this question on this thread. I am looking at setting up a new DC for a school. Are we still saying server 2025 is still in beta?

 

Best to avoid? Remember this will be a new DC, going to start afresh with policies etc.

 

Do let me know.

 

Kind regards

 

5nowman

[PotNoodleTech]

I would avoid until next year.

 

But then I like 100% uptime.

[ITGuyNW]

I tend to keep a version behind. I probably won't put 2025 into production until 2028 comes out.

[ErDT]

14 hours ago, 5nowman said:

Hi, sorry to ask this question on this thread. I am looking at setting up a new DC for a school. Are we still saying server 2025 is still in beta?

 

Best to avoid? Remember this will be a new DC, going to start afresh with policies etc.

 

Do let me know.

 

Kind regards

 

5nowman

If your workstations are on 24H2 then you shouldn't have many problems (we have seen 2 devices on 24h2 have an issue still), i am circa 30 days on from moving workstations to 24H2 with 2025 DC's and this morning saw 50+ devices onsite reset their workstation password correctly. Do not do it if you are on 23H2 as im no longer even testing this once i was aware 24H2 was a fix so the issue could still be present.

[Jawloms]

I have two DCs. One is 2019, the other is still 2016! Obviously I want to upgrade and hope to over Easter. Am I best going to 2022 instead of 2025 atm? If 2022, there's an "Updated March '25" download available. Is that safe, or do I go to the 2022 which was released in 2021?

[Cat_Jam148]

Recently switched over to 2025 for the DC, been running for just over a month and not had any issues. All clients here are Win11 24H2.

 

This was a fresh install, not an in-place upgrade (which is a bad idea anyway for DCs).

Edited March 31, 2025 by Cat_Jam148

[DrCheese]

9 minutes ago, Jawloms said:

I have two DCs. One is 2019, the other is still 2016! Obviously I want to upgrade and hope to over Easter. Am I best going to 2022 instead of 2025 atm? If 2022, there's an "Updated March '25" download available. Is that safe, or do I go to the 2022 which was released in 2021?

 

YES - Stick to 2022.

 

I created one 2025 DC (out of three) in January. I've since had machines that won't renew their machine account passwords & various kerberos issues.

This was a completely fresh build (Never in place DCs) & the issues weren't immediately apparent.

All cleared up by going back to 2022 last week.

 

https://learn.microsoft.com/en-us/answers/questions/2185050/server-2025-domain-controllers-trust-relationship

 

If you google "Server 2025 Kerberos issues reddit" you'll see a whole heap of threads as well.

 

It's just not worth it currently - You don't gain anything other than a pretty new GUI.

 

Edited March 31, 2025 by DrCheese

[ErDT]

13 minutes ago, Jawloms said:

I have two DCs. One is 2019, the other is still 2016! Obviously I want to upgrade and hope to over Easter. Am I best going to 2022 instead of 2025 atm? If 2022, there's an "Updated March '25" download available. Is that safe, or do I go to the 2022 which was released in 2021?

If 2022 then definitely get the latest iso from March 25, shouldn't ever use old ones unless there's a known issue with the latest. 2022 shouldn't have any significant risk to upgrade to, i did it to 30+ DC's a couple of years ago. 

 

2025 i think still has some risks if your estate is not on 24H2.

 

The thread linked to below by Dr Cheese is actually mine, so i have done a significant amount of testing and would suggest the above.

https://learn.microsoft.com/en-us/answers/questions/2185050/server-2025-domain-controllers-trust-relationship

Edited March 31, 2025 by ErDT

[Jawloms]

1 minute ago, ErDT said:

If 2022 then definitely get the latest iso from March 25, shouldn't ever use old ones unless there's a known issue with the latest. 2022 shouldn't have any significant risk to upgrade to, i did it to 30+ DC's a couple of years ago. 

 

2025 i think still has some risks if your estate is not on 24H2.

Yeah, I wasn't sure if the March 2025 one might be so new that issues haven't been found with it yet!

[DrCheese]

1 minute ago, Jawloms said:

Yeah, I wasn't sure if the March 2025 one might be so new that issues haven't been found with it yet!

 

It's just the RTM build of Windows 2022 but with all the latest updates included, so you don't have to jump up to those before doing anything. Saves a lot of time.

 

Edited March 31, 2025 by DrCheese

[ErDT]

Also i think worth noting is I'm not pushing 2025 to the other 30+ DC's we have because we have too many desktops/laptops across our network on 23H2 still. Its a slow old process getting them up to 24H2 because a lot are not considered compliant and so will not automatically push up to 24H2 therefore need hands on rebuilds. So i would lend caution to doing it if you are a large organisation. If a single site single/double DC then the risk is a lot lower as long as you are confident your estate is primarily off 23H2.

Edited March 31, 2025 by ErDT

[5nowman]

1 hour ago, ErDT said:

Also i think worth noting is I'm not pushing 2025 to the other 30+ DC's we have because we have too many desktops/laptops across our network on 23H2 still. Its a slow old process getting them up to 24H2 because a lot are not considered compliant and so will not automatically push up to 24H2 therefore need hands on rebuilds. So i would lend caution to doing it if you are a large organisation. If a single site single/double DC then the risk is a lot lower as long as you are confident your estate is primarily off 23H2.

 

i just gotta figure out what 23H2 means lol.. I'd be installing the latest release on microsoft ovs portal! 1 DC 100 clients.. server 2025 SHOULD be ok hopefully?

Edited March 31, 2025 by 5nowman

[k-strider]

you can use this info from a powershell cmdlet to get the various os and versions

Get-ADComputer -Filter * -Property * | Select-Object Name,Enabled,OperatingSystem,OperatingSystemServicePack,OperatingSystemVersion,DistinguishedName,CanonicalName,Modified   | Export-CSV AllWindows.csv -NoTypeInformation -Encoding UTF8

 

then open the csv in excel and sort by Operating System then OperatingSystemVersion

ref here for build numbers https://en.wikipedia.org/wiki/Windows_11_version_history

23H2 22631

24H2 26100

 

[5nowman]

so basically, if you are installing the latest release of windows 11 then server 2025 should be ok.

otherwise stick to server 2022

 

[ErDT]

10 hours ago, 5nowman said:

so basically, if you are installing the latest release of windows 11 then server 2025 should be ok.

otherwise stick to server 2022

 

Generally yes this is what i have found. I'm only aware of 2 machines out of hundreds where they were on 24H2 where this wasn't the case but as they were previously on 23H2 I'm fairly sure their Kerberos issue somehow followed them into 24H2 where for 99% of the machines it has not once upgraded.

[DrCheese]

I still wouldn't deploy Server 2025 as a DC at this time, even with 24H2 clients which all of ours were...

 

[Arthur]

Microsoft fixes auth issues on Windows Server, Windows 11 24H2

 

Quote

Microsoft has fixed a known issue causing authentication problems when Credential Guard is enabled on systems using the Kerberos PKINIT pre-auth security protocol.

 

According to Redmond, these authentication issues impact both client (Windows 11, version 24H2) and server (Windows Server 2025) platforms, albeit only in some niche scenarios.

 

On affected systems, users experience problems because the passwords aren't rotating correctly when using the Identity Update Manager certificate/Pre-Bootstrapping Key Initialization (PKINIT) protocol.

 

"With this issue, devices fail to change their password every 30 days as the default interval. Because of this failure, devices are perceived as stale, disabled, or deleted, leading to user authentication issues," Microsoft explained in a Windows release health dashboard update.

 

Microsoft says the issue was fixed in April 2025 with Windows security updates for Windows 11 24H2 and Windows Server 2025. However, it also added that it disabled Machine Accounts in Credential Guard, a feature dependent on Kerberos password rotation, until a permanent fix is found.

 

Edited April 9, 2025 by Arthur

[psydii]

14 years  after I first noticed it,  and exacerbated by the demise of the technet blogs and RSS feeds, I am still puzzled how Arthur manages to  remain so on the bleeding edge of update news.

 

To comment on this particular update though, Microsoft seem to have "fixed it" with a work-around, excluding certain things from protection by 'Credential Gurad.'

 

The patch notes I think being the first place Microsoft announced the disablement of this feature, and its new, quirky spelling:

April 8, 2025—KB5055523 (OS Build 26100.3775) - Microsoft Support

• [Authentication] This update addresses an issue affecting machine password rotation in the Identity Update Manager certificate/Public Key Cryptography for Initial Authentication (PKNIT) path. This issue occurred particularly when Kerberos was used and Credential Guard was enabled, potentially causing user authentication problems. The feature Machine Accounts in Credential Gurad, which is dependent on password rotation via Kerberos, has also been disabled, until a permanent fix is made available.