Why windows 11 24H2 causing domain user login issue?

same answer on other forum topic. replied several times to same moderator but no real relpy. please fix MS. this is not an answer but a stall. (Window 11 24H2 / Can't Join Domain - Microsoft Community)

Hi SURENDRANADH M S,

Thank you for posting in the Microsoft Community Forums.

Here are some possible solutions and troubleshooting steps for the problem that domain users are unable to log on, change their passwords, and display “Unable to read configuration information from domain controllers” after Windows 11 24H2 upgrade as you mentioned:

First, check the network connection

First of all, make sure that the network connection between your computer and the domain controller is normal. You can try to ping the IP address of the domain controller to see if it can communicate normally. If there is a problem with the network connection, you need to solve the network problem before proceeding with subsequent operations.

Check the status of the domain controller

Log on to the domain controller: Log on to the domain controller using an account with administrator privileges.

Check the service status: Make sure that Net Logon, DFS Replication, DNS Server (if the domain controller also acts as a DNS server) and other related services are running.

Check the Event Viewer: Open the Event Viewer on the domain controller to see if there are any authentication or domain-related error events.

Third, check the client computer settings

DNS Settings: Ensure that the DNS settings of the client computer are correct and able to resolve the domain name of the domain controller.

Network adapter settings: Check the network adapter settings to make sure that you have not enabled any settings (such as IPv6 filtering, etc.) that may cause network communication problems.

Firewall settings: Make sure that the firewall settings are not blocking communication with the domain controller.

Reset Computer Accounts

Sometimes the computer account may have problems in the domain, resulting in the inability to authenticate correctly. You can try to reset the computer account:

Log on to the domain controller: Log on to the domain controller using an account with administrator privileges.

Open Active Directory Users and Computers: Open the Active Directory Users and Computers management tool on the domain controller.

Locate the computer account: Locate the computer account in question in the Computers container.

Reset Account: Right-click on the computer account and select Reset Account. This will reset the computer's password and allow it to re-authenticate with the domain controller.

Restart Client Computer: Restart the computer on the client computer so that it can rejoin the domain with a new password.

V. Check Group Policy and Permission Settings

Check Group Policies: Ensure that no Group Policy settings have been applied that could cause authentication problems.

Check Permissions: Ensure that domain users have sufficient permissions to log on to computers and change passwords.

Best regards

Neuvi

Hi SURENDRANADH M S,

Based on the information you have provided, it seems that the issue you are experiencing is related to the domain controller configuration. We recommend that you check the domain controller settings and ensure that they are properly configured.

I've seen this in a couple of cases:

The domain might be configured to only use kerberos encryption methods no longer supported in 24H2

To check an endpoint:

(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Kerberos\Parameters').SupportedEncryptionTypes

If this key is set, you have a Policy impacting allowed encryption types the value can be checked here: Decrypting the Selection of Supported Kerberos Encryption Types | Microsoft Community Hub

This can be set in the Default domain and/or default Domain controller policy

Before changing this setting make sure all endpoints are compatible with the new setting, adding encryption types should be fine, removing types might lock out systems that only support that algorithm.

To check configured values from the AD look into the gpo's or use this PowerShell command to retrieve active values:

Get-ADObject -Filter 'msDS-SupportedEncryptionTypes -like "*"' -Properties msDS-SupportedEncryptionTypes

We hope this information helps.