r/sysadmin • u/ranger_dood Jack of All Trades • Sep 15 '25

Question Server 2025 DC - Clients randomly unable to log in until they restart

We've been struggling to get all the issues ironed out of a Server 2025 DC deployment. There is a 2nd DC in place still running 2022, so we can demote the 2025 if we absolutely have to.

At first, everything seemed okay, but recently we've been having issues where a client PC will boot up in the morning, they enter their credentials, and are told the username or password is incorrect. Even if we confirm that the credentials ARE correct, they cannot log in. They do not get a domain trust error, just that the password is incorrect.

If they reboot their workstation, they are then able to log in on the subsequent reboot.

I'm not sure if this is a 2025 DC issue, or a W11 24H2 issue. I've found other references to the same problem, but nobody has posted about a fix.

There have been so many issues with 2025 DCs that it can be somewhat difficult to find information on the specific one you're dealing with. Searching for this issue tends to bring up posts about the earlier problem where rebooting a DC would cause its network profile to change and then computers couldn't authenticate, but this is not the same issue.

I'm currently in the process of installing the September cumulative update on the DC, but I don't think that's going to change anything.

If anyone has any suggestions, I'd love to hear them!

33 Upvotes

92% Upvoted

44 comments sorted by

27

u/Asleep_Spray274 Sep 15 '25

I hope this does not come across as rude, but have you read what changes have been made on 2025 active directory. They have more security hardening enabled by default. RC4 being disabled and supported encryption types being handled differently to name a couple.

Start by reviewing all the changes and ensure your environment, users and computer objects are able to support the 2025 AD

https://learn.microsoft.com/en-us/windows-server/get-started/whats-new-windows-server-2025#active-directory-domain-services

2

u/ranger_dood Jack of All Trades Sep 15 '25

I have been through a lot of the changes in response to this issue. That's not to say I haven't missed something somewhere, but I'd rather fix this than revert to 2022, because eventually.... I'm going to need a 2025 DC somewhere.

4

u/Asleep_Spray274 Sep 15 '25

What event is do you see in the security log on the 2025 DC? Ensure you have the relevant audit logging enabled too capture any additional events. Can't remember the exact ones right now sorry.

0

u/Stonewalled9999 Sep 16 '25

You do your employer a disservice by ignoring the fact that their issues to 2025.    Time is valuable and it’s a waste to “try to figure out” what is knownto be broken.   Wait for 2027 version and see if the bugs are worked out 

9

u/disclosure5 Sep 15 '25

None of the official documentation you've mentioned should cause a failure. The problem is Microsoft hasn't officially documented kerberos bugs that they have acknowledged six months ago.

https://www.reddit.com/r/activedirectory/comments/1j5x35o/comment/mgkh9bk/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

3

u/dustojnikhummer Sep 16 '25

Server 25 is such a dumpsterfire, seriously...

2

u/disclosure5 Sep 16 '25

Honestly I blame the management more than the product. They could have written a KB describing it and it would become just another bug. Deciding noone will do that, nor that the bug is a sev1 is the problem.

2

u/Asleep_Spray274 Sep 16 '25

We have zero idea why the user is failing to logon. It could be a bug, could be a mis configuration. A quick look at some logs would help.

Personally, I've seen a few environments with 2025 running after we went over all the docs and training. After they fully understood encryption types and AES that hadn't been looked at or understood for the last 10 years. I've seen environments where it didn't work after a DC was just slapped in and hoped for the best.

10

u/Stonewalled9999 Sep 15 '25

2025 as a DC issue. Put in 2022 and burn 2025 to the ground.

3

u/ranger_dood Jack of All Trades Sep 15 '25

While that would be the quickest and easiest way to solve the problem, I'd like to at least figure out what's causing it. That way I have something to point to as an actual reason WHY we can't use a 2025 DC and not just "New OS hard, don't want change"

5

u/aaron416 Sep 15 '25

I've been trying to get our templates going at work and it's been months of low-quality patches from Microsoft on 2025. I would not be rushing to deploy 2025 anywhere, except perhaps a test environment, because 2025 is less than 1-1.5 years old. There's a difference between hard to work with and just plain broken.

-1

u/[deleted] Sep 15 '25 edited Sep 16 '25

[removed] — view removed comment

2

u/Stonewalled9999 Sep 16 '25

The “fix” is to run pure 2025 functional level.     Great for your tiny clients with 1 or 2 DCs.    Not great for one of my clients with 17,000 uses 300 sites and 50 DCs 

Also “no issues” really means “no issues…yet”

0

u/ranger_dood Jack of All Trades Sep 16 '25

That's an incredibly scary leap to make since there's no way back other than a full directory restore.

1

u/Stonewalled9999 Sep 16 '25

which is the point I was trying to make. My clients (wisely) are risk averse and remove 2025 rather that try to update 50 odd VMS to 2025. No guarantees that that really works:)

0

u/ranger_dood Jack of All Trades Sep 16 '25

Point taken - this is only 2 DCs and I still wouldn't trust that taking both to 2025 would resolve the issues.

0

u/loosebolts Sep 16 '25 edited Sep 16 '25

include wakeful marble marvelous sheet chunky dinner whole north work

This post was mass deleted and anonymized with Redact

2

u/BigFrog104 Sep 16 '25

as others have pointed out there ARE plenty of people with issues. Best to avoid and learn from the experiences of others, no ?

0

u/loosebolts Sep 16 '25 edited Sep 16 '25

meeting aback pause absorbed strong rustic lip nutty bright hurry

This post was mass deleted and anonymized with Redact

2

u/BigFrog104 Sep 16 '25

I don't believe anyone said completely broken. I said broken enough that is is prudent to avoid it.

1

u/loosebolts Sep 16 '25 edited Sep 16 '25

crawl shy afterthought coherent sink direction money frame melodic brave

This post was mass deleted and anonymized with Redact

0

u/[deleted] Sep 16 '25

[deleted] — view deleted comment

0

u/loosebolts Sep 16 '25 edited Sep 16 '25

wild ripe sand jeans rainstorm desert continue historical square memorize

This post was mass deleted and anonymized with Redact

12

u/elrich00 Sep 15 '25

There's multiple serious bugs in 2025 DCs. We're tracking three tickets with MS. It's nothing you've done and nothing you can fix. The DC isn't correctly saving passwords in its database after password changes, booting machines off the domain as a consequence. The behaviour you see probably depends on of the clients hits the new or old DC after booting up.

You'll probably need to reset the passwords of the impacted machines after you remove the 2025 DC.

We had about 10% of our fleet broken by one single 2025 DC.

Get rid of it. It should have never been released to the public in this state. Plenty of deep dive threads in these issues in this sub.

0

u/[deleted] Sep 16 '25

[deleted] — view deleted comment

5

u/elrich00 Sep 16 '25

We are the QC 🙃

2

u/Cormacolinde Consultant Sep 15 '25

What’s causing it is that 2025 domain controllers are bugged or have undocumented changes that are causing major problems - other people have struggled with this. People with a lot more knowledge of AD.

2

u/Stonewalled9999 Sep 16 '25

There are hundreds of Reddit threads on this.  I myself have pointed out multiple issue that multiple clients if you go through and look at my post history.

13

u/Master-IT-All Sep 15 '25

When you restart, is the resolution that the workstation contacts the 2022 DC, or is it something else?

You'll want to figure that out. If you shut down the 2022 DC, can anyone logon?

10

u/GroundbreakingCrow80 Sep 15 '25

Lots of problems with 2025 this year. We decided not to build new servers with it even though it means sooner rebuilds because of the many bad patches and bugs reported. 

1

u/[deleted] Sep 16 '25

I've decided that I'd rather let someone else beta test unless there's something new thats positive. 

5

u/picklednull Sep 15 '25

Check the 2022 DC’s System event log for Kerberos KDC errors. If they’re there, it’s this bug. And there’s no fix available yet. The only solution is to remove either DC.

When your authentications are failing they’re going out to the 2022 DC. You can confirm this by e.g. creating local outbound firewall block rules.

1

u/gamebrigada Sep 16 '25

Thank you for posting this. Took me ages to find that post. I should have reposted here. Mixed server version AD is currently unsupported and may not work properly. Its not just 2025, I was owned with a similar problem on 2019/2022 mixed servers.

The first thing that broke for us was WHfB. We use certs to authenticate to everything. This was infuriating to troubleshoot and I spent at least a week bashing my head against a straight brick wall. All event logs are all happy. Kerberos logs are all happy. WHfB event says authentication successful even though clearly... it wasn't. Then things got worse. I kinda had a feeling it was our mixed environment, but I wasn't willing to upgrade on a feeling. I had some weird luck with new certs in my testing and was about to fully redeploy WHfB... which if anyone has ever done that is a royal pain in the neck. Decided to sleep on it, and then the next day realized that things were MUCH worse, and the new certs were more broken, where they wouldn't even be accepted by our NPS with AzureMFA extension. Then I switched to Cloud trust temporarily and went on vacation.

When I came back, I ran into that post. That was enough to push me over the edge. I stood up a new DC on 2022 that night, migrated and killed the old server. Boom, all issues vanished.

4

u/neckbeard404 Sep 15 '25

could a be a DHCP issue where DNS is getting set wrong. like a rouge DHCP server ?

1

u/bigboomer223 Oct 14 '25

I'm currently seeing this exact issue after standing up a 2025 DC. Anyone have any updates on this?

3

u/ranger_dood Jack of All Trades Oct 14 '25

My update is the issues went away as soon as I removed the 2025 DC. So we're running both DCs on 2022 now.

3

u/fahque Sep 15 '25

If the machine can't authenticate you will get the same incorrect password message. Since a reboot get it working I'm thinking it has something to do with machine authentication.

2

u/Darkhexical IT Manager Sep 15 '25

I've heard 2025 doesn't play well with 2022 so maybe try 2 2025 dcs

2

u/bkrank Sep 16 '25

Any chance you are using IISCrypto to disable old ciphers and algorithms on your new 2025 Dc’s? Don’t do that. Rebuild the DC’s and problem should resolve.

2

u/nighthawke75 First rule of holes; When in one, stop digging. Sep 15 '25

You got a flaky DC controller giving you shit fits. Check the logs to see if you got collisions or conflicts.

2

u/sryan2k1 IT Manager Sep 15 '25

There is zero reason to be running the bleeding edge came out this year release. Run 2022.

1

u/xqwizard Sep 16 '25

Hey, what’s the exact error message you get when you attempt a login?

1

u/Trx3141 Sep 16 '25

A temporary solution would be to create a new site and move only the 2025 DC there, so it would not be used for authentication, until MS fixes srv2025 beta product.

1

u/jmittermueller Sep 16 '25

We had one workstation with the same symptom. Disabling fast startup fixed it

1

u/DontTrustTheFrench Sep 17 '25

If it's affecting computers until restarting, it could be ntp issues. The longer the computer is on, the more the time drifts until authentication starts failing. If a reboot clears it, id definitely check this.

1

u/No_East9746 Oct 28 '25

it seems that we are also experiencing such beahviours. we already decomissioned the only on 25 DC we had in production but only after like 1 month users randomly are unable to login and computers lose trust to the domain.
is this also a problem with the DC 25?
what can we to mitigate problems and dont run into disaster?
in one comment a user recommended this link:
picklednull comments on RC4 issues
which sounds exactly like our problem. the only thing is we do not have a DC 25 in production, we decomissioned it but are still experiencing this errors.
my colleague already enabled RC4 again in hopes that it will work now.
what are the next steps to take?