Window 11 24H2 / Can't Join Domain

Good Day, we had a similar issue with our domain joined devices. Specifically when upgrading to Win11 24H2.

What we found was a Encryption policy during GPO assignment was not deploying to devices.

The policy in question is located under the following location:

Local Computer Policy - Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Options.

Policy is called Network Security: Configure Encryption types allowed for Kerberos. And we then enabled the following options to be applied from GPO:

RC4_HMAC_MD5

AES128_HMAC_SHA1

AES256_HMAC_SHA1

Future encryption types

Also a good idea to check the following on the client side that is not joining and updating the reg key provided for it to receive the policy.

Also a good idea to test this policy first before deploying to all devices.

On the client side

1. If a policy is specifying a kerberos encryption key then you will need to change the following in the registry
2. The key will not be present if a policy is not applied
3. Faulty entry in registry

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Sofware\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\

Value Name: SupportedEncryptionTypes

Type: REG_DWORD
Value: 1, 2, or 3 are a finding.

1. Registry Hive: HKEY_LOCAL_MACHINE
   Registry Path: \Sofware\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\

change to Value Name: SupportedEncryptionTypes       7ffffffc 2. Pc will need to restarted 3. Run a gpupdate /force to enforce the new policies

Our functional Domain Level is Server 2016

 Hope this info is of assistance
Regards

this needs to be patched quickly. I am currently disconnected from our domain and can only make connection over VPN. this works but is ultra slow. I have been looking for downloading the older windows 11 23H2 (that worked) but can no longer be downloaded to "roll back". this is inflicting serious malfunction for our company, so I would say this is urgent. asking for us to mess around in domain zones and whatever, or registries is something MS cant afford. we are not all geeks and depend on the system to work. please fix SOON

any news yet?

still working around with VPN.

as if it was possible to still get 23H2 version somewhere, that would help. Then we were able to roll back, even trough reinstall.

Now we are stuck with 24H2 that has this big issue with domains......

I tried this method, changes in gpedit and registry, but not solved. Still my laptop is not connecting with domain.

Is there any other options.

some response from MS would be nice! or even better a patch or something. this is not at-home-stuff this is corporate. our daily work is touched by this and is realy holding back our workflow. please escalate!