Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

Hello Erin Teu,

Thank you for posting in Microsoft Community forum.

Do you have one Windows server 2022 Domain Controller and four Windows server 2025 Domain Controllers, am I right?

Here is some general advice on troubleshooting your issue.

1. Review Event Logs:

Check the event logs on the domain controllers and affected workstations for any error messages or warnings related to password updates and trust relationships. This can provide more insight into what's causing the issue.

2. Apply Updates and Patches:

Make sure all servers, especially the ones running 2025, are fully updated with the latest patches and updates. Sometimes, bugs are fixed in subsequent patches.

3. Verify AD Replication:

Confirm that Active Directory replication is functioning correctly between all domain controllers. Issues with replication can sometimes cause problems with attribute updates like pwdLastSet.

Please run commands below on PDC. If there is no error of the command result, it seems AD replication works fine.

repadmin /showrepl >C:\rep1.txt
repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

4. Group Policy Settings:

Review your Group Policy settings to ensure there are no policies that might be affecting the ability of workstations to update their passwords.

5. Check Time Synchronization:

Ensure all domain controllers and workstations are synchronized to the same time source. Time discrepancies can cause various issues in a domain environment, including problems with password updates and trust relationships.

6. Workstation Configuration:

Confirm that the workstations are correctly configured to communicate with the updated domain controllers.

Tips:

I am sorry, I do not have Windows server 2025 in my lab. I suggest you can try to set up only one 2025 Windows server Domain Controller in one single domain in one forest. Then check if there is such problem.

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,

Daisy Zhou

Hi Daisy

We have 4 2025 DC's now and 30+ 2022 DC's. Below are responses to your points.

1. I have reviewed event logs which is what makes me believe there is a bug with server 2025 in the way it is attempting to change passwords of computer objects, to me it looks like the kerberos process is broken and so the DC and workstation go out of sync with each others passwords held.
2. All workstations have latest patches and are on windows 11 23h2. Servers are on latest cumulative patches for server 2025.
3. AD replication is fine. Tests you suggested confirm this.
4. Group policy settings are no different from server 2022 to 2025 so this should not be the cause unless server 2025 is behaving incorrectly or in a way contrary to AD defaults, if you can specify any specific settings i can look at them as i am testing a few different changes to see if there is any effect but have not seen anything work as of yet.
5. Time is up to date and in sync with AD.
6. There is no difference on workstation configuration pre or post server upgrades to 2025 so unless you can specify what config needs changing i am not aware of anything that would cause this issue within our policies when i looked through them.

This feels like a bigger bug, which may not hit all networks but i've seen forums posts about this issue and so its definitely hitting at least a subset of Active Directory infrastructures.

Are there no current bugs etc linked to server 2025 domain controllers that relate to this issue?

Best Regards

Erin

Hello Erin Teu,

Thank you for posting in Microsoft Community forum.

Do you have one Windows server 2022 Domain Controller and four Windows server 2025 Domain Controllers, am I right?

Here is some general advice on troubleshooting your issue.

1. Review Event Logs:

Check the event logs on the domain controllers and affected workstations for any error messages or warnings related to password updates and trust relationships. This can provide more insight into what's causing the issue.

2. Apply Updates and Patches:

Make sure all servers, especially the ones running 2025, are fully updated with the latest patches and updates. Sometimes, bugs are fixed in subsequent patches.

3. Verify AD Replication:

Confirm that Active Directory replication is functioning correctly between all domain controllers. Issues with replication can sometimes cause problems with attribute updates like pwdLastSet.

Please run commands below on PDC. If there is no error of the command result, it seems AD replication works fine.

repadmin /showrepl >C:\rep1.txt
repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

4. Group Policy Settings:

Review your Group Policy settings to ensure there are no policies that might be affecting the ability of workstations to update their passwords.

5. Check Time Synchronization:

Ensure all domain controllers and workstations are synchronized to the same time source. Time discrepancies can cause various issues in a domain environment, including problems with password updates and trust relationships.

6. Workstation Configuration:

Confirm that the workstations are correctly configured to communicate with the updated domain controllers.

Tips:

I am sorry, I do not have Windows server 2025 in my lab. I suggest you can try to set up only one 2025 Windows server Domain Controller in one single domain in one forest. Then check if there is such problem.

 

I hope the information above is helpful.

 

If you have any question or concern, please feel free to let us know.

 

Best Regards,

Daisy Zhou

Hello

Greetings!

Are there no current bugs etc linked to server 2025 domain controllers that relate to this issue?

A: I suggest you can try to set up only one 2025 Windows server Domain Controller in one single domain in one forest. Then check if there is such problem.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Hi Daisy

That's not really helpful, I'm sure there are plenty of organisation's with no issues otherwise you would have every organisation in the world at these forums complaining. Me creating a stand alone domain without an understanding of what would be the cause is not going to help troubleshoot the issue.

I am seeing the trust relationship breaking on 2 networks now with Server 2025 domain controllers. One is standalone, the other has 3 DCs. I am putting this fix out there as it has helped work around most of the issues temporarily.

The fix so far has been:

1. Unplug network cable on client machine
2. Log into the machine using a cached or local administrator account
3. Connect network cable
4. Run "reset-computermachinepassword -credentials domain\domainadminuser -server domaincontroller"
5. Disable and enable the network connection or reboot

Client machines are other Server 2025 servers, other DCs, and Windows 11 Pro workstations that have upgraded to 24H2. One network is an in-place upgrade from Server 2022 and the other is a fresh Server 2025 install. The in-place had a fresh DC installed with the page size altered to the 32k page size. The previous DCs were demoted and then enrolled to pick up the new 32k page size.

I am still troubleshooting and trying to locate event logs that are relevant.

My gut feeling is due to NTLMv1 being removed as I am seeing several Kerberos pre-authentication errors in the logs around the timeframes the issues start occurring. Event ID 4771

I also found some of the machines lost rights to update their own records in DNS as the GUID for their computer object has changed.

My guess is many large organizations have not updated to Server 2025 yet, so all these behaviors will be noticed on smaller test networks first.