Windows Server 2025 trust relationship issues - resolution?

Question

Windows Server 2025 trust relationship issues - resolution?

Joe Grover 646

I see a number of posts online about this dating back to the release of Server 2025, but wondering what the root cause/fix is.

We deployed two new servers in March that had Windows Server 2025. Users at both of these locations are periodically having issues when logging into the domain, getting the error that the trust relationship has failed between the workstation and the domain controller.

We can fix it using Reset-ComputerMachinePassword or Test-ComputerSecureChannel -Repair, but the problem persists--sometimes with the same machine.

Some people have posted that the issue does not affect Windows 11 24H2, but we have plenty of affected 24H2 machines (including one that we just freshly imaged last week and logged into the domain in one regional office, then shipped it out to the end user in an affected office who immediately had this problem trying to log in for the first time).

I see some people pointing at KB5055523 as a workaround patch until a final solution is applied, but all affected servers and workstations already have this patch applied from the cumulative updates.

I'm sure there's something I'm missing, but I'm not sure what.

0 comments

Answer accepted by question author

Harry Phan 32,185 Independent Advisor

Dear Joe Grover,

Based on your report and similar cases across the community, the issue appears to stem from changes introduced in Windows Server 2025 that affect secure channel maintenance between domain-joined devices and domain controllers. Specifically:

Devices intermittently fail to authenticate with the domain, resulting in the error: “The trust relationship between this workstation and the primary domain failed.”
The issue persists even after using Reset-ComputerMachinePassword or Test-ComputerSecureChannel -Repair.
Affected environments often have all domain controllers upgraded to Server 2025, and the issue is more prevalent in clients running Windows 10/11 up to 24H2, though some 24H2 machines are still impacted2.

The root cause is linked to how Windows Server 2025 handles machine account password changes, which are essential for maintaining trust relationships. When all domain controllers are upgraded, certain security protocols may prevent clients from updating their machine account passwords, leading to authentication failures.

A temporary workaround has been identified:

On Domain Controllers:

Policy: Domain controller: Refuse machine account password changes

Setting: Enabled

On Domain Members:

Policy: Domain member: Maximum machine account password age
Setting: 0

You mentioned that KB5055523 has already been applied. This cumulative update addresses several Kerberos-related issues, but it does not fully resolve the trust relationship failures in all environments. Microsoft is actively investigating the issue and may release further updates to address the underlying protocol behavior5.

We recommend the following:

Implement the temporary Group Policy workaround to stabilize affected machines.

Monitor Microsoft’s update channels for a permanent resolution.

Consider retaining at least one older domain controller (e.g., Server 2022) if feasible, as mixed environments appear less affected.

Use Intune or similar tools to deploy automated remediation scripts for affected endpoints, especially in distributed environments.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

Best regards,

Harry Phan

Joe Grover 646 Reputation points

2025-08-19T12:48:25.98+00:00

Thank you, Harry. This is exactly what I was looking for. I'll implement these workarounds and will report back if there are any issues.
Westdyk, Dane 0 Reputation points

2025-09-17T13:49:57.8233333+00:00

Any update on this? Typically, when "Domain controller: Refuse machine account password changes" is enabled, the DC refuses machine account password changes which eventually breaks the trust.
Albi 5 Reputation points

2025-10-13T21:42:45.4333333+00:00

Does the proposed workaround work ? Is there any updated/better solution for this issue ?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
BrandoAUTigers 5 Reputation points

2025-10-14T20:29:32.3066667+00:00

I also wonder if there is better solutions. I don't have the staff to monitor 6 domains with hundreds of users constantly. Fixing these issues are running them ragged.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Eric LE CORRE 35 Reputation points

2026-01-13T15:27:31.24+00:00

any update to resolve this ? KB from microsoft ?
John 10 Reputation points

2026-01-30T18:07:12.3+00:00

@Harry Phan

You mentioned that KB5055523 has already been applied. This cumulative update addresses several Kerberos-related issues, but it does not fully resolve the trust relationship failures in all environments. Microsoft is actively investigating the issue and may release further updates to address the underlying protocol behavior.

Our Microsoft Unified Support representative reviewed the internal resources for the this issue and stated that there is currently no published ETA or official statement regarding a forthcoming fix.

Given that, do you have any documentation, internal references, or credible sources to support the claim that Microsoft is actively investigating this specific trust‑relationship behavior? Any pointers would be greatly appreciated.
Eric LE CORRE 35 Reputation points

2026-02-02T15:03:50.5533333+00:00

we opened ticket with Microsoft Support. we are waiting for response. Domain member: Maximum machine account password age not working for us ! still computers with trust relationship errors
Eric LE CORRE 35 Reputation points

2026-02-09T09:06:03.0166667+00:00

still waiting from Microsoft solution after opened ticket. We are testing upgrade to 25H2 on computers, seems better, we have to test longer...
adam900331 371 Reputation points

2026-07-22T09:56:34.2766667+00:00

Hy! Are there any update related this issue? Any solution?

1 additional answer

Your answer

Joe Grover 646 Reputation points

2025-08-19T12:48:25.98+00:00

Thank you, Harry. This is exactly what I was looking for. I'll implement these workarounds and will report back if there are any issues.
Westdyk, Dane 0 Reputation points

2025-09-17T13:49:57.8233333+00:00

Any update on this? Typically, when "Domain controller: Refuse machine account password changes" is enabled, the DC refuses machine account password changes which eventually breaks the trust.
Albi 5 Reputation points

2025-10-13T21:42:45.4333333+00:00

Does the proposed workaround work ? Is there any updated/better solution for this issue ?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
BrandoAUTigers 5 Reputation points

2025-10-14T20:29:32.3066667+00:00

I also wonder if there is better solutions. I don't have the staff to monitor 6 domains with hundreds of users constantly. Fixing these issues are running them ragged.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Eric LE CORRE 35 Reputation points

2026-01-13T15:27:31.24+00:00

any update to resolve this ? KB from microsoft ?
John 10 Reputation points

2026-01-30T18:07:12.3+00:00

@Harry Phan

You mentioned that KB5055523 has already been applied. This cumulative update addresses several Kerberos-related issues, but it does not fully resolve the trust relationship failures in all environments. Microsoft is actively investigating the issue and may release further updates to address the underlying protocol behavior.

Our Microsoft Unified Support representative reviewed the internal resources for the this issue and stated that there is currently no published ETA or official statement regarding a forthcoming fix.

Given that, do you have any documentation, internal references, or credible sources to support the claim that Microsoft is actively investigating this specific trust‑relationship behavior? Any pointers would be greatly appreciated.
Eric LE CORRE 35 Reputation points

2026-02-02T15:03:50.5533333+00:00

we opened ticket with Microsoft Support. we are waiting for response. Domain member: Maximum machine account password age not working for us ! still computers with trust relationship errors
Eric LE CORRE 35 Reputation points

2026-02-09T09:06:03.0166667+00:00

still waiting from Microsoft solution after opened ticket. We are testing upgrade to 25H2 on computers, seems better, we have to test longer...
adam900331 371 Reputation points

2026-07-22T09:56:34.2766667+00:00

Hy! Are there any update related this issue? Any solution?

Answer 1

Eric LE CORRE 35

no more troubles since we migrato 25H2

0 comments