Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

I stumbled across this article because I was researching upgrading to Server 2025 DC's in preparation for our Win11 migration. This is going to sound off topic but, I swear I am having a very similar issue on Server 2016 DC's with Windows 10 22H2 wks. Started a couple months ago where all the sudden, a few random users try to log in and they are throwing bad password events even though, they are entering the correct password. Account locks and we have to unlock it but unless they are very fast, the account will lock again within seconds. DC's show hundreds of event 4771 Kerberos pre-authentication failed. Rebooting the user does not fix the issue. If their machine gets locked, they cannot log in again until we unlock the account. The next day, problem stops as fast as it started. This happens about every 30 days and to a different group of random users. I have tried just about everything I've read to resolve the issue and had no success. Was hoping the upgrades would just get us past it but sounds like out of the frying pan and into the fire situation.

Check the attribute "msDSSupprtedEncryptionTypes" in the AttributeList on the 2025 domain controller machine object in AD.

Check the attribute "msDSSupprtedEncryptionTypes" in the AttributeList on the failing workstation machine object in AD.

Are they the same ?

If the failing workstations attribute is RC4, AES128, AES 256 and the Domain Controller only has AES 128, AES 256,

remove RC4 on the workstation and reboot.

That removal can be done in many ways.

A suggestion is to make a test-OU and put the failing workstation in it, make a GPO with setting "Security Options" ->AES128_HMAC_SHA1, AES256_HMAC_SHA1 and "Future encryption types". Restart when it takes effect.

OR

Make a new GPO for the existing OU and only put the failing workstation in it.

Check the AttributeList on both ADMachine Objects to see if they ar the same.

Are they the same ?

In my case it is 2016 domain but both DC and Workstation match 100% on encryption types. Thx though! Will pay attention to that when I upgrade.

Anyone saw the new win 11 24h2 patch KB5050094?

It is fixing a domain join bug. Maybe it is changing something for our Problem?

Maybe someone can try it out

We have updated our endpoints from 23H2 to 24H2 (January 28th) version and it seems to be resolving our issues so far. We recently moved to Server 2025 domain from 2016 and any endpoint running on 23H2 fell off the domain and lost its trust.