Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

Anonymous
2025-01-03T12:18:07+00:00

Hi

We have 4 Domain controllers upgraded to server 2025 and about 30+ still on 2022. The newly upgraded servers appear to have a bug where by any workstations going through them are unable to update their "pwdLastSet" value and so after the 30 day limit on that field is hit they then fall into a trust relationship issue with the domain. Is this a known bug of server 2025? Are there any known fixes for this issue?

Windows for business | Windows Server | Directory services | Active Directory

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

54 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-01-14T09:22:59+00:00

    Hi Daisy,

    If you create a new user, can you log into the Windows 11 23H2 machine with the new user credentials?

    Was this answer helpful?

    0 comments
  2. Anonymous
    2025-01-14T09:15:31+00:00

    Hello

    Good day!

    I can see the pwdlastset is not changed on one Win 11 Enterprise 23h2 client.

    But I can sign in it using domain administrator.

    Image

    However, if I create a new domain user, I can not sign in the machine with trust relationship fails.

    Please feedback this issue via "Feedback Hub" on one client machine (such as Win 11).

    Best Regards，

    Daisy Zhou

    Was this answer helpful?

    0 comments
  3. Anonymous
    2025-01-13T17:12:15+00:00

    And? What is the fix?:)

    Was this answer helpful?

    0 comments
  4. Anonymous
    2025-01-13T13:31:13+00:00

    Then i will Post my experience here also.

    I can say that the Version of Windows 11 is not interesting. Im also in a school and we have win11 22h2,23h2,24h2 clients. Everybody has the Mistake. I think it is not possibile to fix at the moment. Only with gpo for machinepassword.

    Im really sure that it has something to do with Kerberos Error ID 7. Everytime when someone is logging in with trust Problems it will show up in event log of the dc.Maybe server patch from tomorrow will fix it?
    We will see

    Was this answer helpful?

    0 comments
  5. Anonymous
    2025-01-10T08:25:49+00:00

    Was reading last night and think possibly the Kerberos aspect is an effect of the issue rather than the route cause, as it appears the machine password change process is totally controlled by the local machine and uses Netlogon (RPC) to do it, so am wondering if theres something broken in that, possibly related to the below hardening on server 2025. Just another possibility as I'm going in a bunch of different directions with possible fixes at the moment but as yet nothing appears to rectify it.

    Was this answer helpful?

    0 comments