mulbzh Posted January 28 Posted January 28 (edited) i am really lost about troubles with win 2025 and trust relationship. We don't find the solution, our computers and DC are up to date but still problems. We try also migrate some computers to last 25H2, but not better. Still kerberos errors security logs with ID 4771 : Kerberos pre-authentication failed. Command reset-computerMahcinePassword resolve temporarily , with GPO to disable password machine change it is not better. replication between DC is good, DNS records OK, time sync OK, ports open OK on DC We test also nltest /sc_verify:CONTOSO.local on DC. On one DC we have error but if i look at this article this seems normal : https://www.dell.com/support/kbdoc/en-us/000226052/domain we will open ticket to Microsoft... Edited January 28 by mulbzh
mulbzh Posted February 3 Posted February 3 For now, the Microsoft technician checked everything on domain controlers and computers and the configuration is OK. kerberos encryption is good, gpo, is good, DNS is good... He doesn't find the solution for the moment
aac Posted February 3 Posted February 3 Hi there your not alone with this. We had a 2019 and a 2025 DC and issues with group policy not applying so in the end to resolve the group policy issues we upgraded the 2019 DC to 2025 and that sorted it but to this day we are still finding some machines do not rotate machine password and therefore loose trust with the domain thus I am having to run a script on these machines monthly to rotate the passwords manually. Even if it has already lost trust with the domain it still works and saves a trip to the machine re-joining manually... 1
mulbzh Posted February 3 Posted February 3 (edited) It is possible to have your script ? We test upgrade on computers to 25H2, for the moment it seems better... for the moment no relationship error Edited February 3 by mulbzh
aac Posted February 3 Posted February 3 (edited) See the script below. I just added it in the software library/scripts section of SCCM then just run it on affected machines each month. Even if it says password rotation for machine failed after running on affected machine just reboot the affected machine and you will see it worked fine. I personally don't think 25h2 fixes anything but reimaging an affected machine does. Unfortunately in my scenario I just don't have time ATM to reimage the affected machines some of which have a few extra apps to install after reimaging so I will just run the script for now as I am building a new image and will reimage all machines later... try { Write-Host "Starting machine password rotation..." Write-Host "Running as: $(whoami)" # Define credentials (plain text password converted to SecureString) $Username = "domain\username" # Replace with your delegated account $Password = ConvertTo-SecureString "password" -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential ($Username, $Password) # Specify a domain controller explicitly $DomainController = "test.domain.internal" # Replace with your DC name # Reset the machine account password using provided credentials Reset-ComputerMachinePassword -Server $DomainController -Credential $Cred -Verbose # Verify secure channel if (Test-ComputerSecureChannel) { Write-Host "Machine password successfully rotated." Exit 0 } else { Write-Host "Password rotation failed: Secure channel test failed." Exit 1 } } catch { Write-Host "Error rotating machine password: $($_.Exception.Message)" Exit 1 } Edited February 3 by aac 1
mulbzh Posted February 4 Posted February 4 ok thanks. So, for the moment the technician Microsoft still don't find the solution.... waiting...
aac Posted February 4 Posted February 4 Cool, let us know please if Microsoft get anywhere with it. They must have known this issue existed for a a long while now...
mulbzh Posted February 4 Posted February 4 (edited) 6 minutes ago, aac said: Cool, let us know please if Microsoft get anywhere with it. They must have known this issue existed for a a long while now... yes sure because the first call with the technician, he said : 'so many troubles with windows 2025.... you should not migrate to windows 2025 !" and yes, i will post here solution from Microsoft Edited February 4 by mulbzh 2
mulbzh Posted February 5 Posted February 5 so bad Microsoft support... no solution for the moment and we said we are testing upgrade to 25H2. Microsoft technician tell : 'Ok, tell me if this resolve the troubles'. My response : we don't pay ticket for this, it is not the client who need to provide the solution.... 🙃 1
mulbzh Posted February 6 Posted February 6 (edited) we upgraded 50% of computers to 25H2, we are still testing, for the moment no troubles with this version but we have to test longer to be sure Edited February 6 by mulbzh
tayyab12 Posted February 9 Author Posted February 9 Nice to know my thread is still an issue a year later🤣 my god Microsoft are that clueless even their own techs are saying it. We`ve just stuck on server 2022 till MS actually find a proved solution that these issues are no longer there. Support is till 2031 so does not bother us at all. 1
ITGuyNW Posted February 9 Posted February 9 21 minutes ago, tayyab12 said: Nice to know my thread is still an issue a year later🤣 my god Microsoft are that clueless even their own techs are saying it. We`ve just stuck on server 2022 till MS actually find a proved solution that these issues are no longer there. Support is till 2031 so does not bother us at all. The solution is.... pay us more money and use Azure\Entra instead and we are going to keep breaking server until you do so. 1
mavhc Posted February 9 Posted February 9 1 hour ago, ITGuyNW said: The solution is.... pay us more money and use Azure\Entra instead and we are going to keep breaking server until you do so. Indeed, the sign's been on the wall for a decade now that they don't care about Windows Server
mulbzh Posted February 10 Posted February 10 I am still testing with 25H2, still no more troubles for me.... Regarding Microsoft support, the technician doesn't care about me; he deliberately makes my phone ring only once, then sends an email saying: "I tried to contact you unsuccessfully to discuss the case," and he does this just before finishing his work. Then I immediately reply to his email, and the automatic response is: "I am not currently working...".
mulbzh Posted February 10 Posted February 10 (edited) First action from the Microsoft technician today, on my controlers, he changed : msDS-SupportedEncryptionTypes from 28 to 26 on DC accounts, in attribute editor This change kerberos encryption type from RC4, AES 128, AES 256 to DES_CBC_MD5, AES 128, AES 256 Edited February 10 by mulbzh
mulbzh Posted February 11 Posted February 11 few minutes after changed msDS-SupportedEncryptionType to 26, the attribute change back automatically to 28.... What i see, it is normal because DC see Keberos with RC4 so, the DC change to 28
mulbzh Posted February 13 Posted February 13 (edited) still no errors since we upgraded computers to 25H2 Edited February 13 by mulbzh 1
mavhc Posted February 14 Posted February 14 On 11/02/2026 at 15:35, mulbzh said: few minutes after changed msDS-SupportedEncryptionType to 26, the attribute change back automatically to 28.... What i see, it is normal because DC see Keberos with RC4 so, the DC change to 28 GPO I assume
mulbzh Posted February 14 Posted February 14 10 hours ago, mavhc said: GPO I assume No, i don't have GPO to set encryption configuration. Microsoft technician confirme, the DC can change himself this setting
mulbzh Posted February 16 Posted February 16 (edited) Still no errors with 25h2, we are still waiting to be sure... Edited February 16 by mulbzh
mulbzh Posted February 24 Posted February 24 From technician, the solution is to migrate clients to 25H2 as this resolve for us. But no explanation from Microsoft technician, i don't know what happen....
mulbzh Posted August 26 Posted August 26 (edited) after few months, still no problems since we migrated windows clients to last windows 11 version 🙂 Edited August 26 by mulbzh 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now