Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

Hello,

I only want to inform everybody. We updatet the full domain like 400 clients to 24h2 and deactivate the gpo for password reset time to 120 days. All clients resettet his password instandly sussesfully. No problems anymore. 24h2 defnitly not have the error

Anyone saw the new win 11 24h2 patch KB5050094?

It is fixing a domain join bug. Maybe it is changing something for our Problem?

Maybe someone can try it out

That RPC methods setting is missing from my group policy console even though my entire domain is at the 2025 level. Not sure why I didn't get it. I will try and re-apply the Server 2025 ADMX files. (Edit: reapplying the 2025 Group Policy pack to my DC fixed this missing RPC Methods policy)

I did want to add this update I saw on the Server 2025 release notes:

• Legacy Security Account Manager (SAM) remote procedure call (RPC) password change behavior: Secure protocols such as Kerberos are the preferred way to change domain user passwords. On DCs, the latest SAM RPC password change method SamrUnicodeChangePasswordUser4 by using Advanced Encryption Standard (AES) is accepted by default when it's called remotely. The following legacy SAM RPC methods are blocked by default when they're called remotely:
  • SamrChangePasswordUser
  • SamrOemChangePasswordUser2
  • SamrUnicodeChangePasswordUser2
  For domain users that are members of the Protected Users group and for local accounts on domain member computers, all remote password changes through the legacy SAM RPC interface are blocked by default, including SamrUnicodeChangePasswordUser4. To control this behavior, use the following GPO setting: Computer Configuration > Administrative Templates > System > Security Account Manager > Configure SAM change password RPC methods policy

Hi Daisy

We have 4 2025 DC's now and 30+ 2022 DC's. Below are responses to your points.

1. I have reviewed event logs which is what makes me believe there is a bug with server 2025 in the way it is attempting to change passwords of computer objects, to me it looks like the kerberos process is broken and so the DC and workstation go out of sync with each others passwords held.
2. All workstations have latest patches and are on windows 11 23h2. Servers are on latest cumulative patches for server 2025.
3. AD replication is fine. Tests you suggested confirm this.
4. Group policy settings are no different from server 2022 to 2025 so this should not be the cause unless server 2025 is behaving incorrectly or in a way contrary to AD defaults, if you can specify any specific settings i can look at them as i am testing a few different changes to see if there is any effect but have not seen anything work as of yet.
5. Time is up to date and in sync with AD.
6. There is no difference on workstation configuration pre or post server upgrades to 2025 so unless you can specify what config needs changing i am not aware of anything that would cause this issue within our policies when i looked through them.

This feels like a bigger bug, which may not hit all networks but i've seen forums posts about this issue and so its definitely hitting at least a subset of Active Directory infrastructures.

Are there no current bugs etc linked to server 2025 domain controllers that relate to this issue?

Best Regards

Erin

Hello Erin Teu,

Thank you for posting in Microsoft Community forum.

Do you have one Windows server 2022 Domain Controller and four Windows server 2025 Domain Controllers, am I right?

Here is some general advice on troubleshooting your issue.

1. Review Event Logs:

Check the event logs on the domain controllers and affected workstations for any error messages or warnings related to password updates and trust relationships. This can provide more insight into what's causing the issue.

2. Apply Updates and Patches:

Make sure all servers, especially the ones running 2025, are fully updated with the latest patches and updates. Sometimes, bugs are fixed in subsequent patches.

3. Verify AD Replication:

Confirm that Active Directory replication is functioning correctly between all domain controllers. Issues with replication can sometimes cause problems with attribute updates like pwdLastSet.

Please run commands below on PDC. If there is no error of the command result, it seems AD replication works fine.

repadmin /showrepl >C:\rep1.txt
repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

4. Group Policy Settings:

Review your Group Policy settings to ensure there are no policies that might be affecting the ability of workstations to update their passwords.

5. Check Time Synchronization:

Ensure all domain controllers and workstations are synchronized to the same time source. Time discrepancies can cause various issues in a domain environment, including problems with password updates and trust relationships.

6. Workstation Configuration:

Confirm that the workstations are correctly configured to communicate with the updated domain controllers.

Tips:

I am sorry, I do not have Windows server 2025 in my lab. I suggest you can try to set up only one 2025 Windows server Domain Controller in one single domain in one forest. Then check if there is such problem.

 

I hope the information above is helpful.

 

If you have any question or concern, please feel free to let us know.

 

Best Regards,

Daisy Zhou

Hello Erin Teu,

Thank you for posting in Microsoft Community forum.

Do you have one Windows server 2022 Domain Controller and four Windows server 2025 Domain Controllers, am I right?

Here is some general advice on troubleshooting your issue.

1. Review Event Logs:

Check the event logs on the domain controllers and affected workstations for any error messages or warnings related to password updates and trust relationships. This can provide more insight into what's causing the issue.

2. Apply Updates and Patches:

Make sure all servers, especially the ones running 2025, are fully updated with the latest patches and updates. Sometimes, bugs are fixed in subsequent patches.

3. Verify AD Replication:

Confirm that Active Directory replication is functioning correctly between all domain controllers. Issues with replication can sometimes cause problems with attribute updates like pwdLastSet.

Please run commands below on PDC. If there is no error of the command result, it seems AD replication works fine.

repadmin /showrepl >C:\rep1.txt
repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

4. Group Policy Settings:

Review your Group Policy settings to ensure there are no policies that might be affecting the ability of workstations to update their passwords.

5. Check Time Synchronization:

Ensure all domain controllers and workstations are synchronized to the same time source. Time discrepancies can cause various issues in a domain environment, including problems with password updates and trust relationships.

6. Workstation Configuration:

Confirm that the workstations are correctly configured to communicate with the updated domain controllers.

Tips:

I am sorry, I do not have Windows server 2025 in my lab. I suggest you can try to set up only one 2025 Windows server Domain Controller in one single domain in one forest. Then check if there is such problem.

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,

Daisy Zhou