This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi
We have 4 Domain controllers upgraded to server 2025 and about 30+ still on 2022. The newly upgraded servers appear to have a bug where by any workstations going through them are unable to update their "pwdLastSet" value and so after the 30 day limit on that field is hit they then fall into a trust relationship issue with the domain. Is this a known bug of server 2025? Are there any known fixes for this issue?
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Having a similar issue upgraded my domain controller and it lost trust with the Primary DC that holds the master scheme… I have to disable the KDC service to even sign into the domain controller impacted…. No fix available very disappointed I have to rebuild back on 2022…
Hi, we have the same problem like everyone is talking about.
As a workaround we created a gpo to put it on 60 days. Also we are fast deploying 24H2 to all of our pc's. As we can't see any bugs anymore.
When will there be a fix? This is a major bug i presume? Does Microsoft acknowledge the problem and are writing on a fix?
Thx for the update!
Hi,
Just to add my experience. This is something broken in Windows Server 2025.
Since upgrading my DCs to 2025 my ESXi servers which are domain members also complain they can’t update their computer account passwords (it’s a pretty constant error).
Those errors on ESXi are:
<27>2025-01-17T12:01:39.026Z <ESXI SERVER> lwsmd[265009]: [lsass] Error: Failed to change machine password for <AD DOMAIN NAME> (error = 5)
Also, if I try and join a RedHat instance to the domain using the SSSD method it fails saying it can’t set the machine password in AD. If I join them using the old winbind method they work.
Server 2025 has broken something for most computers trying to change their AD machine password.
I have the password change issue on AD member servers based on Windows Server 2025.
AD is on Server 2019 or 2022. Domain and forest level is on 2016.
Doesn't matter if upgraded or fresh installed. All my Windows Server 2025 cannot automatically update their password.
They keep the initial password and do still work after the 30 days expiry date.
Windows 11 23H2 or 24H2 have no issue.
Password can be updated with the PowerShell command but not automatically.
January 2025 patches did not help.
Waiting for MS to solve this issue!
We are having the problem as well.
DC at 2025.
Win11 at 23H2 (due to really buggy 24H2 and hybrid domain trust problems).
Using the Reset-ComputerMachinePassword does fix the problem for the domain members temporarily but I've noticed not always. I wrote a script to do a domain trust audit on everything (using Test-ComputerSecureChannel that returns false) and noticed that there are a couple machines already with domain trust problems with pwdLastSet being just a few days old. So I had fixed a machine and it's now broken even before the 30 day mark.
