Created an account just so I could post this:
Hi Matthew,
Greetings from Microsoft!
Thank you for your detailed update and for sharing the timeline and observations regarding the issue following the upgrade of your Domain Controller to Windows Server 2025.
Based on your description and recent findings from both Microsoft and the broader IT community, the issue you're encountering is part of a known bug affecting Windows Server 2025 Domain Controllers, particularly in environments with Windows 11 23H2 clients.
Issue Summary
Error Message: “The Security Account Manager failed a KDC request in an unexpected way.”
Lookup Type: 0x108
Client Impact: A Windows 11 23H2 laptop lost its trust relationship with the domain shortly after the 2025 DC was introduced.
Root Cause (As Identified by Microsoft and Community Reports)
Kerberos Bug in Server 2025:
A bug in the Kerberos implementation of Server 2025 causes failures when processing timestamps beyond the year 2038.
This affects TGT issuance, Cisco RADIUS integrations, and client authentication.
The issue is traced to the krb5int_gmt_mktime function in the Kerberos library
Machine Account Password Update Failure:
Workstations authenticating against 2025 DCs are unable to update their pwdLastSet attribute.
After 30 days, the machine password expires, resulting in trust relationship failures.
No Fix Available Yet:
As of the latest updates, Microsoft has not released a patch to address this issue.
The problem persists even after the February 2025 cumulative update.
️ Recommended Actions
Immediate Workarounds
Repair Trust on Affected Clients: Run the following on the affected machine:
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
Temporarily Disable Machine Password Changes (if needed):
reg add HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters /v DisablePasswordChange /t REG_DWORD /d 1 /f
Reset Computer Account in AD:
Reset the machine account in Active Directory.
Rejoin the domain if necessary.
Optional: Isolate the 2025 DC
If the issue is widespread, consider:
Adjusting site link costs to prevent clients from authenticating against the 2025 DC.
Or temporarily demoting the 2025 DC until a fix is available.
References
Microsoft Q&A: Server 2025 Domain Controllers - Trust relationship issues [1]
Microsoft Learn: Broken trust relationship between domain-joined device and its domain [2]
Next Steps
We recommend implementing the above workarounds for affected clients and monitoring for further issues. We are also actively tracking updates from Microsoft and will notify you as soon as a fix is released.
Please let us know if you'd like assistance applying any of these steps or if you'd prefer to temporarily isolate the 2025 DC from authentication duties.
