Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

Anonymous
2025-01-03T12:18:07+00:00

Hi

We have 4 Domain controllers upgraded to server 2025 and about 30+ still on 2022. The newly upgraded servers appear to have a bug where by any workstations going through them are unable to update their "pwdLastSet" value and so after the 30 day limit on that field is hit they then fall into a trust relationship issue with the domain. Is this a known bug of server 2025? Are there any known fixes for this issue?

Windows for business | Windows Server | Directory services | Active Directory

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

54 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-01-24T06:49:27+00:00

    Hey Gabriel,

    your Point: - User passwords change via Ctrl+Alt+Supr options is also affected.

    shouldnt be a Problem actually but i can say i also had it after installing my 2025 DCs.

    For me it was a Different Time between my two DCs. 2025 has a Time Issue.

    Maybe it can help you

    Was this answer helpful?

    0 comments
  2. Anonymous
    2025-01-23T22:45:28+00:00

    Just wanted to report that my business is also suffering from this bug. We are working as fast as we can to roll out 24H2 but it crippled my IT department for a day trying to deal with trust issues on thousands of devices.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2025-01-23T12:30:13+00:00

    This is indeed a legitimate issue. We had the same issue, still with varying drops among members (no servers dropped). It seems that older machines are not affected, they may have a RC4+AES128/256 SHA1 encryption type only (with no futures), just guessing, no tests have been done.
    Still i tested Linux Kerberos clients extensively, they are affected too:

    https://gitlab.freedesktop.org/realmd/adcli/-/issues/40

    We had to change password computer account via ldap password reset (it directly writing ldap object properties).

    What happens:

    • Trust-dropping machines: Password is actually changed via Kerberos flow (DC writes the new value in AD DS), but it reports an error message. Machine receives the error, so it discards the new krb5.keytab and maintains the older one. This results in a mismatch between lcoal machine password, and AD DS hashes. Machine passwords do not expire, so it is the password resets that breaks trust between machine and ADDS, we put a password reset cycle of 120d so we can wait a CU.
    • Non trust dropping machines, but they have not updated password in a while. Same as before, but they fail before, and password is not actually changed in DS.
    • User passwords change via Ctrl+Alt+Supr options is also affected.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2025-01-20T07:46:34+00:00

    Hello Erin Teu,

    Greetings！

    If Microsoft sees the feedback, they will definitely be active in fixing or fixing the problem. I've seen other people on the forum have the same issue as you, and I think they're going to give feedback, too, and I'm sure Microsoft will take this issue very seriously.

    As a temporary solution, it is recommended that you update your computer's password for a longer period of time. Please be patient and wait for Microsoft's update.

    Thank you for your efforts, understanding and support.

    Best Regards,
    Daisy Zhou

    Was this answer helpful?

    0 comments
  5. Anonymous
    2025-01-19T12:57:38+00:00

    We have the same issues. Workstation relationships is broken. We have 5 2025 DCs and have raised the domain. We were able to fix the relationship again by running Test-ComputerSecureChannel -Repair -Credential (Get-Gredential), but it gets broken again after a certain amount of days

    Was this answer helpful?

    0 comments