Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

Anonymous
2025-01-03T12:18:07+00:00

Hi

We have 4 Domain controllers upgraded to server 2025 and about 30+ still on 2022. The newly upgraded servers appear to have a bug where by any workstations going through them are unable to update their "pwdLastSet" value and so after the 30 day limit on that field is hit they then fall into a trust relationship issue with the domain. Is this a known bug of server 2025? Are there any known fixes for this issue?

Windows for business | Windows Server | Directory services | Active Directory

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

54 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2025-01-07T07:47:08+00:00

    We have the exact same issue in our domain. Above fix solves the issue indeed. Is this issue already known at microsoft somewhere? We are still checking on which Windows 11 systems this issue occurs.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2025-01-07T15:00:14+00:00

    Hi,

    We are doing the secure channel repairs as well but this only lasts the 30 days that a machines password is valid for by default so not a long term fix.

    I also believe its either related to a kerberos breakage in information exchange or ntlm reference when the machine does the password update, as the manual methods of rebuilding the securechannel via "Test-ComputerSecureChannel -Repair -Credential $credential" repairs the machines connection to the domain for a further 30 days because it can actually reset its password correctly where whatever the default method microsoft is using cannot.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2025-01-07T15:17:06+00:00

    Also for anyone with the same issue if you can remotely run the below script on the machine it will repair the secure channel to the domain. Just update the username and password variables for your local domains. This can be run remotely on a machine even if its sat in a broken state, without the need to actually login unplug etc. Once run correctly it will return values of true or false, and once its reconnected the machine to the domain you can login straight away.

    $username = "domain\adminaccount"

    $password = "password for account" | ConvertTo-SecureString -AsPlainText -Force

    $credential = [PSCredential]::new($username, $password)

    Test-ComputerSecureChannel -Repair -Credential $credential

    Was this answer helpful?

    0 comments
  4. Anonymous
    2025-01-08T12:51:21+00:00

    Hello

    Greetings!

    I have set up one domain with one 2025 DC.

    And add one member server 2025 into this domain.

    I change the group policy setting below to one domain.

    I will check pwdlastset value and trust relationship next day.

    Best Regards,
    Daisy Zhou

    Was this answer helpful?

    0 comments
  5. Anonymous
    2025-01-08T12:59:15+00:00

    Hi Daisy

    Is the workstation you are testing with windows 11 23H2?

    I have confirmed that a classroom of iMacs that are integrated into our AD have all been able to reset their windows pwdlastset field fine. I have the impression the issue is linked between windows 11 23H2 and server 2025. It could also be other versions but cant confirm totally outside of 23H2 as that's what our end devices are on.

    Was this answer helpful?

    0 comments