Server 2025 Domain Controllers - Trust relationship issues on workstations after 30 days as "pwdLastSet" value unable to be updated

Anonymous
2025-01-03T12:18:07+00:00

Hi

We have 4 Domain controllers upgraded to server 2025 and about 30+ still on 2022. The newly upgraded servers appear to have a bug where by any workstations going through them are unable to update their "pwdLastSet" value and so after the 30 day limit on that field is hit they then fall into a trust relationship issue with the domain. Is this a known bug of server 2025? Are there any known fixes for this issue?

Windows for business | Windows Server | Directory services | Active Directory

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

54 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2025-01-17T12:13:23+00:00

    Hi,

    Just to add my experience. This is something broken in Windows Server 2025.

    Since upgrading my DCs to 2025 my ESXi servers which are domain members also complain they can’t update their computer account passwords (it’s a pretty constant error).

    Those errors on ESXi are:

    <27>2025-01-17T12:01:39.026Z <ESXI SERVER> lwsmd[265009]: [lsass] Error: Failed to change machine password for <AD DOMAIN NAME> (error = 5)

    Also, if I try and join a RedHat instance to the domain using the SSSD method it fails saying it can’t set the machine password in AD. If I join them using the old winbind method they work.

    Server 2025 has broken something for most computers trying to change their AD machine password.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2025-01-17T17:19:34+00:00

    Hi, we have the same problem like everyone is talking about.

    As a workaround we created a gpo to put it on 60 days. Also we are fast deploying 24H2 to all of our pc's. As we can't see any bugs anymore.

    When will there be a fix? This is a major bug i presume? Does Microsoft acknowledge the problem and are writing on a fix?

    Thx for the update!

    Was this answer helpful?

    0 comments
  3. Anonymous
    2025-01-18T16:35:47+00:00

    Having a similar issue upgraded my domain controller and it lost trust with the Primary DC that holds the master scheme… I have to disable the KDC service to even sign into the domain controller impacted…. No fix available very disappointed I have to rebuild back on 2022…

    Was this answer helpful?

    0 comments
  4. Anonymous
    2025-01-19T12:57:38+00:00

    We have the same issues. Workstation relationships is broken. We have 5 2025 DCs and have raised the domain. We were able to fix the relationship again by running Test-ComputerSecureChannel -Repair -Credential (Get-Gredential), but it gets broken again after a certain amount of days

    Was this answer helpful?

    0 comments
  5. Anonymous
    2025-01-20T07:46:34+00:00

    Hello Erin Teu,

    Greetings！

    If Microsoft sees the feedback, they will definitely be active in fixing or fixing the problem. I've seen other people on the forum have the same issue as you, and I think they're going to give feedback, too, and I'm sure Microsoft will take this issue very seriously.

    As a temporary solution, it is recommended that you update your computer's password for a longer period of time. Please be patient and wait for Microsoft's update.

    Thank you for your efforts, understanding and support.

    Best Regards,
    Daisy Zhou

    Was this answer helpful?

    0 comments