Found this thread after going through VERY similar issues here ... I have a very old domain, it kicked off way back in 2003 and has been successively upgraded to each new Server as the years progressed. Like many of you - I ran some MS Patches a few weeks ago and have been absolutely smashed now with all kinds of issues on my once harmonious domain.
I went down this same rabbithole with ChatGPT over the past week and discovered ALL of our User and Computer accounts were still using old RC4 authentication even though they all had the ability to use AES 128 and AES256 and it was falling back to that, successfully, for years - until MS released that patch a few weeks ago. I had ChatGPT walk me through and created a few scripts that updates ALL Users and PC's to be set at 28, meaning they are now using AES128 and AES256 and I thought well 'job done' ... but now my network is running like a proverbial Dog and I'm suspecting its a DNS issue, but intermittently, and its killing the network
First users were reporting SSL errors going to HTTPS websites ... digging in, on the affected website, it was showing the proxy cert from our Sophos Firewall instead of the sites expected websites SSL cert. Then users were sending me screenshots of Security Alerts in Outlook with Outlook reporting SSL errors with autodiscover.outlook.com (we run Hybrid O365) and again its showing our Firewalls cert and not the expected outlook certs. I double checked the firewall - SSL Scanning is NOT enabled anywhere (as ChatGPT said it was doing). I re-added firewall exceptions (even though they were already in my master list of O354 exceptions that included SSL Scanning, Cert checks etc). I checked with users and a few refreshes of the web browser or waiting 10 minutes and trying again - and it worked fine. But then would come up with the exact same errors minutes later. Same thing was happening with my ADSyncCycles from the DC. I could run it manually from powershell and it would sync fine ... then two minutes later it would spit out a bunch of errors because the connection attempt timed out. Then just the internet was abysmally slow for everyone ... all the hallmarks of a DNS issue somewhere ... but all my DC's tested fine, DNS said it was working fine, every DCDIAG was coming up clean and successful.
I've created a new service account and given it FULL permissions to every single DNS forward and reverse zone, added it into DHCP (Advanced, DNS Dynamic update creds), and added the account to the DNSProxy group in AD. Both DC' point at each other in DNS, then 127.0.0.0 as secondary's ... I'm coming up with nada and still have a dirt slow network ...
I am also <--> close to running up a 2022 server and dumping 2025 ...
