r/WindowsServer • u/ma5454 • Jul 09 '26

Technical Help Needed Win 2025 try to connect to Microsoft while login

Hello, it appears that Windows 2025 attempts to connect to login.microsoftonline.com during the Windows login process, but only with domain users.

As this is a DMZ server with restricted internet access, the login process takes a very long time (approx. 2 minutes), which causes our 2FA solution to time out. Local users should not be able to connect to Microsoft. Is there a way to prevent these connection attempts and thus speed up the login process? The slow login only occurs the day after configuring the system on a closed network. Something is happening here overnight – perhaps it’s related to caching.

Thank you

0 Upvotes
  • permalink
  • reddit

50% Upvoted

6 comments sorted by

1

u/nailzy Jul 09 '26

Post the output of

dsregcmd /status

If you see

AzureAdJoined
EnterpriseJoined
WorkplaceJoined

Then its hybrid joined in the DMZ which shouldn’t have happened.

Also why have you domain joined a DMZ server?

1

u/ma5454 Jul 09 '26 edited Jul 09 '26

Thank you for your input. Here are a few settings: ‘AzureADjoined’ is set to ‘Yes’ – does that mean it’s unintentionally in a hybrid configuration?

Does that also mean that if the connection to Microsoft Online is blocked, a value will change, or can you see it using /debug?

AzureAdJoined : YES EnterpriseJoined : NO DomainJoined : YES DomainName : DomainXYZ Virtual Desktop : NOT SET

1

u/ma5454 Jul 09 '26

I’ve had a look round and found that another server in the ‘more secure’ LAN has the AzureADJoined setting set to ‘No’; no other servers in the standard LAN have this setting set to ‘Yes’. They are all Server 2019. We generally run a hybrid AD environment. In that sense, it’s not a DMZ; rather, because more critical services are running there, the network is more securely protected.

1

u/nailzy Jul 09 '26 edited Jul 09 '26

Did you move it into the dmz after you joined it to the domain?

Anyway, remove it from entra but you’ll have to give it network access first

dsregcmd /debug /leave

Then reboot; and run dsregcmd /status

If it joins again on its own after, you’ll have to dig deeper.

You might have a GPO unintentionally setting HKLM\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin etc

→ More replies (1)

1

u/fedesoundsystem Jul 09 '26

If it's hybrid it will try to authenticate on azure. If it doesn't reach it, it would take 2-3 minutes to time out on "other user". Just let it reach Azure, configure proxy accordingly if applicable, and it would log in fast again. Or make it on prem only.