Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

Hello

Greetings!

I have set up one domain with one 2025 DC.

And add one member server 2025 into this domain.

I change the group policy setting below to one domain.

I will check pwdlastset value and trust relationship next day.

Best Regards,
Daisy Zhou

Also for anyone with the same issue if you can remotely run the below script on the machine it will repair the secure channel to the domain. Just update the username and password variables for your local domains. This can be run remotely on a machine even if its sat in a broken state, without the need to actually login unplug etc. Once run correctly it will return values of true or false, and once its reconnected the machine to the domain you can login straight away.

$username = "domain\adminaccount"

$password = "password for account" | ConvertTo-SecureString -AsPlainText -Force

$credential = [PSCredential]::new($username, $password)

Test-ComputerSecureChannel -Repair -Credential $credential

Hi,

We are doing the secure channel repairs as well but this only lasts the 30 days that a machines password is valid for by default so not a long term fix.

I also believe its either related to a kerberos breakage in information exchange or ntlm reference when the machine does the password update, as the manual methods of rebuilding the securechannel via "Test-ComputerSecureChannel -Repair -Credential $credential" repairs the machines connection to the domain for a further 30 days because it can actually reset its password correctly where whatever the default method microsoft is using cannot.

We have the exact same issue in our domain. Above fix solves the issue indeed. Is this issue already known at microsoft somewhere? We are still checking on which Windows 11 systems this issue occurs.

I am seeing the trust relationship breaking on 2 networks now with Server 2025 domain controllers. One is standalone, the other has 3 DCs. I am putting this fix out there as it has helped work around most of the issues temporarily.

The fix so far has been:

1. Unplug network cable on client machine
2. Log into the machine using a cached or local administrator account
3. Connect network cable
4. Run "reset-computermachinepassword -credentials domain\domainadminuser -server domaincontroller"
5. Disable and enable the network connection or reboot

Client machines are other Server 2025 servers, other DCs, and Windows 11 Pro workstations that have upgraded to 24H2. One network is an in-place upgrade from Server 2022 and the other is a fresh Server 2025 install. The in-place had a fresh DC installed with the page size altered to the 32k page size. The previous DCs were demoted and then enrolled to pick up the new 32k page size.

I am still troubleshooting and trying to locate event logs that are relevant.

My gut feeling is due to NTLMv1 being removed as I am seeing several Kerberos pre-authentication errors in the logs around the timeframes the issues start occurring. Event ID 4771

I also found some of the machines lost rights to update their own records in DNS as the GUID for their computer object has changed.

My guess is many large organizations have not updated to Server 2025 yet, so all these behaviors will be noticed on smaller test networks first.