Windows Server 2025 DCs – Intermittent Machine Account Trust Failures After Password Renewal

Eric LE CORRE 35 Reputation points
2026-01-13T19:40:49.51+00:00

hello,

After upgrading Domain Controllers from Windows Server 2016 to Windows Server 2025, multiple Windows 11 23H2 domain-joined computers intermittently lose their secure channel trust with the domain after approximately 30 days.

The issue did not exist on Server 2016 and is reproducible only since the introduction of Server 2025 DCs.

Reset-ComputerMachinePassword temporarily restores trust, but the issue reoccurs after the machine account password renewal cycle.

This strongly suggests a Kerberos / Netlogon machine password update failure on Server 2025.

I don't find the solution and i have a lot of computers with troubles.

thanks

Windows for business | Windows Server | Directory services | Active Directory
0 comments
Answer accepted by question author
HLBui 12,700 Reputation points Independent Advisor
2026-01-13T20:47:56.85+00:00

Dear Eric LE CORRE

Based on your description, the behavior aligns with a known issue related to machine account password renewal cycles when interacting with Server 2025 DCs. The temporary resolution you mentioned (Reset-ComputerMachinePassword) confirms that the trust relationship is restored but does not prevent recurrence.

We has identified that Kerberos/Netlogon interactions in Server 2025 may require updated handling of machine account password changes. A recommended mitigation is to ensure that all DCs are fully patched with the latest cumulative updates for Windows Server 2025, as fixes have been released to address secure channel and Netlogon reliability.

Additionally, please verify that the Domain Functional Level has been raised appropriately after the upgrade, and confirm that replication health across all DCs is consistent. Running dcdiag /test:Netlogons and nltest /sc_verify:<domain> can help validate whether trust updates are propagating correctly.

If the issue persists even after applying updates, a workaround is to configure affected clients to refresh their machine account password more frequently (e.g., via registry modification of MaximumPasswordAge), though this should be considered temporary until the official fix is applied.

I recommend applying the latest patches first, testing replication health, and monitoring whether the trust failures recur. If they do, please share logs from Netlogon and Kerberos event channels so we can escalate further.

I hope this guidance helps stabilize your environment. If you find this answer helpful, please don’t forget to hit “Accept Answer”. That others in community with similar issues can benefit from the guidance. Thank you!

Was this answer helpful?

4 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Eric LE CORRE 35 Reputation points
    2026-03-02T08:41:41.5666667+00:00

    no more troubles since we migrated to 25H2

    Was this answer helpful?

    1 person found this answer helpful.
  2. HLBui 12,700 Reputation points Independent Advisor
    2026-01-14T12:56:05.27+00:00

    Hi Eric LE CORRE

    You’re absolutely right to be puzzled ,many admins have raised this issue for months, and Microsoft has not yet shipped a patch. The reason is that Windows Server 2025 is still in its early lifecycle, and certain deep Netlogon/Kerberos changes introduced there have created unexpected regressions. Microsoft typically prioritizes fixes based on severity and reproducibility, but unfortunately this one hasn’t yet been addressed in a cumulative update.

    To your second point:

    Yes, if you set DisablePasswordChange = 1 in the Netlogon registry, the computer will stop attempting machine account password renewals. That means you won’t need to schedule Reset-ComputerMachinePassword scripts, because the trust relationship won’t break every 30 days.

    But the trade‑off is important: machine account passwords are part of Active Directory’s security model. By freezing them, you reduce the protection against replay or credential theft attacks. In most environments, this is considered a temporary workaround only.

    Was this answer helpful?

  3. HLBui 12,700 Reputation points Independent Advisor
    2026-01-14T11:55:18.8633333+00:00

    Dear Eric LE CORRE

    You’re correct ,this is a widespread, unresolved bug in Windows Server 2025 domain controllers. Many admins (including those in the EduGeek forum you linked) are reporting that Windows 10/11 clients lose their secure channel trust after ~30 days because machine account password updates fail when processed by Server 2025 DCs. Microsoft has not yet released a fix, and the only current options are workarounds.

    Since Microsoft hasn’t patched this yet, admins are relying on these strategies:

    Keep at least one 2016/2019 DC : Machine password updates succeed when routed through older DCs

    Disable machine password changes (DisablePasswordChange=1 in Netlogon registry): Prevents trust failures

    Scheduled resets via PowerShell.: Automates Reset-ComputerMachinePassword before the 30-day expiry

    Force clients to use legacy DCs (via site affinity or DNS): Ensures password updates bypass 2025 DCs

    Recommendations:

    • Safest short-term fix: Keep at least one Windows Server 2016/2019 DC in the domain.
    • If not possible: Script regular machine password resets (every 25–28 days).
    • Avoid disabling password changes unless absolutely necessary.
    • Monitor Microsoft channels (Windows Server release notes, KB articles, TechCommunity) for updates.

    I hope this information can help you solve the problem.

    Please consider hitting “Accept Answer” so we can close the thread with a smile

    Was this answer helpful?

  4. AI answer

    2026-01-13T19:41:00.63+00:00

    It seems that the intermittent machine account trust failures you are experiencing after upgrading to Windows Server 2025 may be related to changes in how Active Directory Domain Controllers (DCs) handle Kerberos authentication and machine account password renewals. After installing the April Windows monthly security update released on April 8, 2025, there were reports of authentication interruptions for DCs processing Kerberos logons, particularly when using certificate-based credentials that rely on key trust. This issue could be affecting the secure channel between your domain-joined computers and the DCs.

    To address this, you might want to check the following:

    1. Registry Setting: Ensure that the Windows registry value AllowNtAuthPolicyBypass in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc is configured correctly. This setting controls the validation method for certificates used in Kerberos authentication.
    2. Update and Patch: Make sure that all your systems, including the domain controllers and the Windows 11 machines, are fully updated with the latest patches from Microsoft, as these updates may address known issues with Kerberos authentication.
    3. Monitor Events: Keep an eye on the event logs for any Kerberos-related errors that may provide more insight into the authentication failures.
    4. Network Configuration: Verify that there are no network issues affecting the communication between the domain-joined computers and the domain controllers.

    If the problem persists, consider reaching out to Microsoft support for further assistance, as they may have additional insights or solutions specific to your environment.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.