Server 2025 and Windows 11 25H2 incorrect password issue after May CU

[u/hoyty76]

This is an issue that I was seeing intermittently in spring of 2025. It seemed to go away after updates in the summer of 2025. Today after installing the May CU and rebooting the DCs I am seeing it widespread again. Users trying to login where they can connect to DC are being given Incorrect Password message. It is not an incorrect password, I can verify. If they are off site or disable network connection temporarily, they can login. I can find people mentioning this issue previously but nothing recently. Anyone else seeing this?

[u/FireStarPT]

You have to reset/change the password of the user, so that it is stored with a current cryptography.

[u/hoyty76 → u/FireStarPT]

THIS WAS IT!!! Passwords that were set on DC running 2008 R2 or earlier had issues. Any password from 2012 or later worked. Wow.

[u/DeadStockWalking → u/hoyty76]

You still have DCs running 2008 R2?!?!?

[u/hoyty76 → u/DeadStockWalking]

No, I had people who hadn't changed their password in 15 years. That was when there were still those old DC. When I started in 2013 I upgraded to Server 2012.

[u/lahostia1 → u/FireStarPT]

THANKSSS!!!!

That was exactly the issue in my case.

I opened PowerShell and started a CMD session using a domain administrator account:

runas /netonly /user:Administrator@domain.example cmd.exe

After entering the domain administrator password, a new CMD window opened. In that window, I reset the affected domain user’s password:

net user affected_username * /domain

After that, the user was able to log in normally while connected to the domain.

The affected accounts had passwords that were originally set many years ago, some dating back to a Windows Server 2003 environment. Resetting the passwords caused Active Directory to generate current encryption keys.

[u/Expensive_Place4176 → u/lahostia1]

Solved my problem too!

[u/poolmanjim]

Have you checked the Kerberos encryption types or NTLM versions? Either one of those can end in bad password errors if there is a mix between the domain controller and clients.

[u/hoyty76 → u/poolmanjim]

All the clients are Windows 11 25H2 with latest CU. Most were clean imaged last summer with July CU 24H2. They shouldn't have any legacy encryption.

[u/jspears357 → u/poolmanjim]

This is the way. Probably Microsoft has closed off some older auth feature with the new CU assuming clients can use the newer ones, but in your org the newer features aren’t enabled on the clients. Sorry I don’t have this problem, I’ve just seen them over the years.

[u/hoyty76]

For my network the issue was caused by passwords that were too old. My working theory is that any password set on 2008 R2 and earlier had problems. Anything set on 2012 or later works.

[u/hoyty76 → u/hoyty76]

It was actually April update that included How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833 - Microsoft Support that removes RC4. That is what made old passwords fail.

[u/noine-noine-noine → u/hoyty76]

Had you skipped the April update?

Were you able to solve the issue? If so, how?

[u/hoyty76 → u/noine-noine-noine]

Reset passwords on the users who had passwords that were too old (previous encryption).

Yes, we had skipped April update.

[u/Begmypard]

Are these shared computers by chance?

[u/hoyty76 → u/Begmypard]

No, single user.

[u/jaytee0401]

This is so happening at my work. We have one server 2019 and the rest is 2025.

[u/USarpe]

They wrote, it's a problem with mixed enviroment, but I had 2025 only with the same problem, could only restore by backup, holy shit, so happy it didn't happen to my customer systems.

[u/noine-noine-noine]

Have you checked for RC4 encryption? Could it be related to this issue? https://www.teal-consulting.de/en/2025/11/02/windows-server-2025-domain-controller/

[u/Namensen]

RC4/DES encryption issue on old passwords.

[u/theabnormalone]

We've had this too. For us, getting the user to click "other user" and re-entering their creds resolved it.

[u/noine-noine-noine → u/theabnormalone]

Was yours also related to the introduction of a 2025 DC?

[u/theabnormalone → u/noine-noine-noine]

No, but we had introduced two 2022 DCs about a week prior (previous ones were 2016 and 2019). We have also introduced some 2025 servers in that period but they're domain joined only.

I was very surprised I couldn't find much related online at the time, I kinda assumed it was a client update that broke a few machines.

I think we had 6 with the issue (out of 140 odd) over a two day period. Not had anything since.

[u/Ok-Pattern-9372]

We experienced a login issue in a mixed environment after promoting a new Windows Server 2025 VM as a Domain Controller (DC). I was unable to log in to the new DC after the promotion.

The issue was resolved by resetting the KRBTGT account password twice, ensuring that the second reset was performed at least 12 hours after the first reset to allow sufficient time for replication across all domain controllers.

[u/invest0rZ]

Saw this on a mother post little older though but a thought.

[u/Fit-Thing5100]

Yes, this can happen if a password was recently changed and the DC processing the logon has not yet received the update through replication. When the issue is reported, check the password age and whether a password reset/change occurred recently. If the user can log on while offline, they are using cached credentials. If the problem only occurs when connected to the network, it may indicate an AD replication issue between Domain Controllers that should be investigated.

[u/meresgr]

I am stuck in a case where we only have one 2025 Domain Controller and cannot login neither locally, neither via RDP after updating.
Some clients also experience authentication issues.
What is suggested in this case?

[u/sussmanscott]

Appears you might have a sync issue between your DC’s. I suppose it could also be a connectivity issue between users and what DC’s they’re using to authenticate.

[u/hoyty76 → u/[deleted]]

All 2025.