Share via

Windows 11 22h2 Problem with Active directory after update

Sylv___ 66 Reputation points
2022-10-14T10:27:10.96+00:00

Hi,

After updating or installing a fresh Windows 11 22H2, the computer can't contact the active directory.
GPO seems to be not applied and it's impossible to reach any ressources on the network.

It seems that the user can't get a TGT from the domain controller.

When I do a klist it's empty.

With wireshark, I see at each attempt an "AS-REQ" but no "AS-REP".

> nltest /dclist:mydomain.local

Get list of DCs in domain 'mydomain.local' from '\\dc01.mydomain.local'.
Cannot DsBind to mydc.laz (\\dc01.mydomain.local).Status = 2148074320 0x80090350 SEC_E_DOWNGRADE_DETECTED.

> nltest /sc_query:mydomain.local

Flags: 30 HAS_IP HAS_TIMESERV Authentication Service: Netlogon
Trusted DC Name \\dc02.mydomain.local
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

When I try to reach an SMB share i have this message :

The sytem cannot contact a domain controller to service the authentication request. Please try again later

All the DCs are in Windows 2016.

I'm not sure where to look to fix this. I've looked everywhere but no answer.
Can you help me please?

Thank you.

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Windows for business | Windows Client for IT Pros | User experience | Other
Accepted answer
  1. nleva 126 Reputation points
    2022-11-14T15:54:01.437+00:00

    Is anyone here using Crowdstrike Falcon Identity protection? There was a post on reddit saying this Windows 11 22H2 authentication issue is caused by falcon identity. 

    Release Notes | Falcon sensor for Windows 6.46.16012/6.47.16104 Hotfix  
Fixed an issue with Falcon Identity Protection that blocked Kerberos authentications performed by hosts running Windows 11 version 22H2. This applies to all prior supported sensor versions.
    3 people found this answer helpful.

18 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Lariviere, Todd 0 Reputation points
    2023-06-19T17:36:53.89+00:00

    I can not run a klist purge on any computer that upgraded from win10 to 11, but any computer I built as win 11 works. Any ideas? User's image

    0 comments
  2. Andrea Masala 1 Reputation point
    2024-11-29T15:20:16.4333333+00:00

    For one of our customers the scenario was:

    Windows 11 client with a fresh Install

    WIndows Server 2016 as a Domain controller

    The client did join the domain but could not update gpo's because coult not access the share under \domain.local\SYSVOL

    a "gpupdate /force" from client resulted in a "could not read policy object 'XXXX-YYYY-ecc' "

    surfing the network path at \domain.local\SYSVOL resulted in a "denied access" with credential request

    Apparently, the solution was to check under the Server side if smb v1 support was still active and then disabling it

    first step was to remove the smb1 feature from "Server Manager":

    • open server manager app \ Manage \ remove roles and Features \ Features : uncheck SMB 1.0/CIFS File sharing Support
    • Reboot the domain controller

    second step check with powershell the status of smb v1 protocol

    • Get-SmbServerConfiguration | Select EnableSMB1Protocol if the output is True, disable it by the command:

    Set-SmbServerConfiguration -EnableSMB1Protocol $false

    issuing again the get command shoul result in a False state

    Typing againg the "gpupdate /force" on the client side resulted in a positive output with no errors and the SYSVOL was now available to the client operating system.

    No action was needed on the client

    hope this helps

    Cheers

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.