Windows Server 2025 DCs / Trust Relationship Issues for PCs

[SKELTON]

Hi all,

I upgraded all of our servers to the latest version of Windows Server 2025 over the Christmas break, including our DCs. Initially I had an issue with one of the DCs post-upgrade where certain services weren't able to start, so instead of wasting time trying to fix this, I span up a new DC (also Windows Server 2025) when we returned after the break.

 

We now have another very frustrating issue where client PCs seem to be dropping off the domain and throwing up trust relationship errors.

 

I'm interested to know if anyone else has experienced similar with Windows Server 2025?

 

Replication is fine between both DCs. I've already implemented a few changes to try and sort it and prevent the issue reappearing, but no joy unfortunately! Aghhh!

[ThatBoringBloke]

Take a look here:- 

 

[ICT_GUY]

I did have to put that gpo back onto the DC and BDC to inforce acceptable encryption between themselves and clients.

Though the two issues I had were constant wrong password errors for users and replication failing between dcs. This was fixed with setting acceptable network encyption in group policy. 

Our set up was different in that one dc was server 2022. So they would sometimes be able to login and sometimes not.

Using echo %logonserver% from a command prompt showed which DC was actually accepting authentication. So even when they had the correct password it would tell the user it was wrong. Rebooting theclient  until the working DC responded worked.

 

 

[SKELTON]

Thank you @ThatBoringBloke - I've already flicked through everything in this post. We are still seeing many 'trust relationship' errors though.

 

Thought it was a smart idea being fully up-to-date on OS versions to be nice and secure... should've done a bit more research beforehand as it seems lots of people have had similar issues!

 

@ICT_GUY - do you remember where the GPO was that you specified encryption types? I enabled AES support in the Default Domain Controllers GPO, and deployed a registry GPO (SupportedEncryptionTypes) to all workstations to force them to use this encryption. I also scripted the update of the msDS-SupportedEncryptionTypes attribute for all workstations on AD too. Seem to be at a bit of a loss now!!

 

Thanks both!

[ICT_GUY]

Network security: Configure encryption types allowed for Kerberos

 

Under computer config, windows settings, security settings, local policies/security options

 

[SKELTON]

Ah yes, that's where I've enabled AES support for the Default Domain Controllers GPO. I think we might just have to wait 30 days and see what happens.

 

Replication between DCs is fine, it just seems that Windows Server 2025 is plagued with issues... still!

 

Thank you!

[ICT_GUY]

I had to apply that tou our clients as well as the servers.

Basicaly so they all agree on what encryption is acceptable. 

[AlphamaleZed]

Did you roll over the KGRBT key by the way? this helps sorts that ours wasn't done in over 20 years lol and dc 25 sprang up like a charm.

It will also be worth testing and rebuilding a machine to see if that works, if it does not then would be your GPO policies where it may be worth restoring the default domain ones.

 

The above solved months of testing to migrate the domain controller back in July.

[SKELTON]

@ICT_GUY thanks, I will try setting this for all domain-joined PCs and see if this changes anything.

 

@AlphamaleZed yes, I was forced to change the KRBTGT password when we upgraded the DCs as one of the DCs locked us out entirely and we were unable to sign in. Was down to the KDC service and after changing the KRBTGT password it worked fine.

[ICT_GUY]

One of the things that came up was that although AES was enabled in the Kerberos encryption-type policy, klist was still showing RC4 service tickets

Reset-ComputerMachinePassword -Server on my server 2022 DC pointing at my new server 2025 server. regenerated the correct keys and now klist shows aes is being used.

Fun times.

 

[AlphamaleZed]

23 hours ago, SKELTON said:

@ICT_GUY thanks, I will try setting this for all domain-joined PCs and see if this changes anything.

 

@AlphamaleZed yes, I was forced to change the KRBTGT password when we upgraded the DCs as one of the DCs locked us out entirely and we were unable to sign in. Was down to the KDC service and after changing the KRBTGT password it worked fine.

Do you have an AD CA Server? this has helped too with the security within the whole domain controller. fixed all small quirks.

[mulbzh]

after migrated clients to 25H2, no more troubles in my company !

[2097]

What forest functional level are the servers ?

[k-strider]

I was just wondering about this, i have 3x 2022 DCs one of which is core, and i recently tried to remove the 2016 DPM client from it and install a newer one for the new DPM server but the old one didn't uninstall (i thought there was an issue as the 2016 client wouldn't take a minor client update for a long time, it would fail and roll back) so for two reasons its time to demote and replace the DC, 1 i really want it not to be a core server and 2 i need the DPM client back on the machine i am going to demote and remove it and then replace it.... as soon as we break up for summer... 8th July for us yeah!!!

 

So naturally you think should I just go straight to 2025 for the replacement DC but the cautious part of me says no just put 2022 on again, and give this issue another year or two before worrying about upgrading the DCs after all 22 has a good length of support left in it...

Estate wise everything is win 11 24 or 25 with maybe 1 or 2 PCs Windows 10 on LTSC. 

[jonnykewell1]

We're seeing this at the moment. I introduced a server 2025 domain controller to the domain recently after one needed to be rebuilt but it seems to have been a good 3 or 4 months before it's kicked in, unless users have just been slow at telling us. 

 

I've seen the other article on here about users having the same issue. I think i'm going to rebuild it again on 2022 for now until something is done about it or some better guidance is distributed online. Some users have said 25H2 solves it but we have a load of machines on 25H2 and they're still experincing the same problem periodically. 

 

We're also seeing random users suddenly saying their password is incorrect and when they move machine it works. 

[AlphamaleZed]

31 minutes ago, jonnykewell1 said:

We're seeing this at the moment. I introduced a server 2025 domain controller to the domain recently after one needed to be rebuilt but it seems to have been a good 3 or 4 months before it's kicked in, unless users have just been slow at telling us. 

 

I've seen the other article on here about users having the same issue. I think i'm going to rebuild it again on 2022 for now until something is done about it or some better guidance is distributed online. Some users have said 25H2 solves it but we have a load of machines on 25H2 and they're still experincing the same problem periodically. 

 

We're also seeing random users suddenly saying their password is incorrect and when they move machine it works. 

Check LDAPS is setup, Rollover KGRBT Keys and you also need an AD CA server for LDAPS and you wont have any issues. took me months to figure!

[k-strider]

8 hours ago, AlphamaleZed said:

Check LDAPS is setup, Rollover KGRBT Keys and you also need an AD CA server for LDAPS and you wont have any issues. took me months to figure!

at least i regularly roll the KGRBT pwd and we have had AD CA in place for years mostly for 802.11x had to do a sha-1 to sha-256 update a few years back... and LDAPS is in place too... 

Still airing on just using 22 for DC again for now

[DrCheese]

Suprised this is still on going - It's nearly 2 years since 2025 came out yet I still read about these issues on here & reddit/sysadmin.  I only ever had the one 2025 DC for a few weeks (About 6 months after release) and ended up having to revert it. 

 

It's fine for everything else, just domain controllers it seems are (somehow) still a no go area, nearly 2 years after release

[Jaan]

I have just booked ourselves a ticket to do this update and wanted to check if this was still a issue..... my understanding was as long as any DCs were on the same server version you were good to go? I guess that isn't the case

 

 

[AlphamaleZed]

10 hours ago, k-strider said:

at least i regularly roll the KGRBT pwd and we have had AD CA in place for years mostly for 802.11x had to do a sha-1 to sha-256 update a few years back... and LDAPS is in place too... 

Still airing on just using 22 for DC again for now

You will need to use modern AD CA certs thats one thing i found once deployed worked a treat had 2025 DCs for over a year and all but one server is 2025 now.

[k-strider]

8 hours ago, AlphamaleZed said:

You will need to use modern AD CA certs thats one thing i found once deployed worked a treat had 2025 DCs for over a year and all but one server is 2025 now.

That's also interesting.. do you remember what you mean by modern AD CA certs???? i do recall in the past few years changing a lot of the certificate templates on the CA server... for what reason i now cant remember but it seemed pressing ish at the time... 

[AlphamaleZed]

19 hours ago, k-strider said:

That's also interesting.. do you remember what you mean by modern AD CA certs???? i do recall in the past few years changing a lot of the certificate templates on the CA server... for what reason i now cant remember but it seemed pressing ish at the time... 

I done it a while back using ChatGPT just ask for the latest information for modern certs as efault gives you the legacy stuff and then push out to all clients and the DCs and other cert they will all need to be republshed.

[psydii]

From the release notes of the preview release in June 2026. The 16th July release states it contains all the updates from the June preview.  The verbiage is a little vague, but there's not much difference between a "member server" and "Windows 11" when it comes to connecting to DCs and the netlogon secure channel. So maybe its fixed now?