This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi
We have 4 Domain controllers upgraded to server 2025 and about 30+ still on 2022. The newly upgraded servers appear to have a bug where by any workstations going through them are unable to update their "pwdLastSet" value and so after the 30 day limit on that field is hit they then fall into a trust relationship issue with the domain. Is this a known bug of server 2025? Are there any known fixes for this issue?
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
We have the same issues. Workstation relationships is broken. We have 5 2025 DCs and have raised the domain. We were able to fix the relationship again by running Test-ComputerSecureChannel -Repair -Credential (Get-Gredential), but it gets broken again after a certain amount of days
Having a similar issue upgraded my domain controller and it lost trust with the Primary DC that holds the master scheme… I have to disable the KDC service to even sign into the domain controller impacted…. No fix available very disappointed I have to rebuild back on 2022…
Hi, we have the same problem like everyone is talking about.
As a workaround we created a gpo to put it on 60 days. Also we are fast deploying 24H2 to all of our pc's. As we can't see any bugs anymore.
When will there be a fix? This is a major bug i presume? Does Microsoft acknowledge the problem and are writing on a fix?
Thx for the update!
Hi,
Just to add my experience. This is something broken in Windows Server 2025.
Since upgrading my DCs to 2025 my ESXi servers which are domain members also complain they can’t update their computer account passwords (it’s a pretty constant error).
Those errors on ESXi are:
<27>2025-01-17T12:01:39.026Z <ESXI SERVER> lwsmd[265009]: [lsass] Error: Failed to change machine password for <AD DOMAIN NAME> (error = 5)
Also, if I try and join a RedHat instance to the domain using the SSSD method it fails saying it can’t set the machine password in AD. If I join them using the old winbind method they work.
Server 2025 has broken something for most computers trying to change their AD machine password.
More confirmation that this is an issue with 23H2
Anything with version 26100 (24H2) is updating.
Anything with version 22631 (23H2) is not updating and generating bad password attempts.
I also am seeing kerberos preauth failures in wireshark captures from both the client and domain controller.
As a test I also added a computer to the domain administrators group in case there may be some strange permissions issue, forced a computer password change, then waited a day (per the test GPO requirements) and the password did not change.
