Windows 11 22h2 Problem with Active directory after update

Sylv___ 66

Hi,

After updating or installing a fresh Windows 11 22H2, the computer can't contact the active directory.
GPO seems to be not applied and it's impossible to reach any ressources on the network.

It seems that the user can't get a TGT from the domain controller.

When I do a klist it's empty.

With wireshark, I see at each attempt an "AS-REQ" but no "AS-REP".

> nltest /dclist:mydomain.local

Get list of DCs in domain 'mydomain.local' from '\\dc01.mydomain.local'.
Cannot DsBind to mydc.laz (\\dc01.mydomain.local).Status = 2148074320 0x80090350 SEC_E_DOWNGRADE_DETECTED.

> nltest /sc_query:mydomain.local

Flags: 30 HAS_IP HAS_TIMESERV Authentication Service: Netlogon
Trusted DC Name \\dc02.mydomain.local
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully

When I try to reach an SMB share i have this message :

The sytem cannot contact a domain controller to service the authentication request. Please try again later

All the DCs are in Windows 2016.

I'm not sure where to look to fix this. I've looked everywhere but no answer.
Can you help me please?

Thank you.

nleva 126 Reputation points

2022-11-07T21:40:56.443+00:00

Same issue here with Windows 11 22H2. One symptom of this problem is "The system cannot contact a domain controller to service the authentication request. Please try again later." when trying to access network resources.
Nathaniel Rose 1 Reputation point

2022-11-08T16:49:50.733+00:00

Chiming in to say we began seeing this as well. Bricked a few machines. Only recourse thus far has been to reimage.
Bryan Vay 11 Reputation points

2022-11-10T00:03:42.99+00:00

Also have this issue. First manifested as something like "My R: drive is disconnected..."

We can map network drives by \ipaddress\sharename but not \hostname\sharename.

nltest /dclist: gets me the same result.

When I try to gpupdate /force, I'm told no DC's can be contacted.

ONLY on W11 22h2. I have tried several Kerberos-related fixes found on Reddit, but no dice.

DC's are 2012R2 as is functional level.
nleva 126 Reputation points

2022-11-10T13:59:37.503+00:00

Is there a reason why posts in this thread seem to be getting deleted? The posts discussing upgrading DCs to 2022 and raising the domain functional level appear to be gone now.
Nathaniel Rose 1 Reputation point

2022-11-10T14:03:09.307+00:00

Perhaps that person figure out it wasn’t a consistent answer and deleted their comments…? (No clue.)
nleva 126 Reputation points

2022-11-14T13:16:13.3+00:00

We increased our domain and forest functional level from 2008 R2 to 2012 R2, but this did not solve the Windows 11 22H2 authentication issue. We'll need to upgrade our domain controllers if we want to increase the functional level further.
TheFixer 6 Reputation points

2022-11-22T01:42:26.517+00:00

I had the same issue when testing 22H2 on Windows 11.

Some of the symptoms - Unable to access DFS Shares or file shares by DNS name, GPUpdate not working, Powershell issues with AD modules and remoting, Certificate waring when using RDP

Our DCs were all running on Windows server 2019 or 2022 but the functional level was still 2012.

Raise your domain functional level to 2016+, this worked for me.
Michael Kiwaczinski 0 Reputation points

2023-08-02T17:41:39.63+00:00

Same. No Trusted relationship

Accepted answer

nleva 126 Reputation points

2022-11-14T15:54:01.437+00:00
Is anyone here using Crowdstrike Falcon Identity protection? There was a post on reddit saying this Windows 11 22H2 authentication issue is caused by falcon identity.

Release Notes | Falcon sensor for Windows 6.46.16012/6.47.16104 Hotfix Fixed an issue with Falcon Identity Protection that blocked Kerberos authentications performed by hosts running Windows 11 version 22H2. This applies to all prior supported sensor versions.
Please sign in to rate this answer.

3 people found this answer helpful.
Sylv___ 66 Reputation points

2022-11-14T16:01:27.863+00:00

We actually do use Falcon Identity Protection !
Thank you for this, I'll check that !!

Bryan Vay 11 Reputation points

2022-11-14T16:05:56.38+00:00

WOW. I'mma go looking at that as I am a customer of CSFalcon (like every module they offer). Headed to look now.

Ben 1 Reputation point

2022-11-14T16:22:13.047+00:00

We use falcon, but I removed it from my computer a few days ago thinking that was the issue also, but it didn't do anything.

Sylv___ 66 Reputation points

2022-11-14T16:24:38.283+00:00

It's the Identity Product that is installed on the Domain Controller that seems to be the problem.

https://falcon.eu-1.crowdstrike.com/support/news/release-notes-falcon-sensor-for-windows-6-46-16012-6-47-16104-hotfix

nleva 126 Reputation points

2022-11-14T16:24:48.96+00:00

Removing it from the computer won't help if it's falcon identity protection causing the issue. The falcon identity sensor is installed on the domain controller and the blocking would be occurring there, not on the pc itself.

Nathaniel Rose 1 Reputation point

2022-11-14T16:30:25.09+00:00

Yup. We're totally Crowdstrike endpoints. Thank you so much for sharing this.

Ben 1 Reputation point

2022-11-14T16:53:21.633+00:00

new update. i updated the sensors on my PC and on the DC and no dice. I haven't rebooted the DC yet. don't know if I have to do that.

Mike 11 Reputation points

2022-11-14T20:10:28.43+00:00

Updating the Falcon sensors on our DC's worked for us. We did not have to reboot them. Thanks!

Marty Bognanno 6 Reputation points

2022-11-15T15:48:37.783+00:00

I removed just the Falcon Identity Sensor from both of my Domain Controllers and now all the Windows 11 22H2 clients are working. They are authenticating and getting Group Policy as normal. I'm not sure if there is a new fix coming from CrowdStrike. The hotfix version of the client didn't take care of the issue. Only removing the Identity Sensor did the trick.

nleva 126 Reputation points

2022-11-15T15:51:45.987+00:00

Crowdstrike told me only the unified DC sensor has been updated. If your account is still uses the DC sensor separate from the falcon EDR sensor we're still waiting for an update to the standalone identity DC sensor. It might be possible to ask crowdstrike to update your account to use the new unified sensor but it requires a change on their side.

Bryan Vay 11 Reputation points

2022-11-15T16:35:47.117+00:00

Putting Identity Protection into "passthrough" mode also worked for us to solve these issues.

I have a ticket with CrowdStrike and they have yet to confirm this issue stems from this module.

nleva 126 Reputation points

2022-11-30T16:46:51.36+00:00

The fixed version of the falcon identity DC standalone sensor has been released. Version 6.48.21772. Has anyone installed it yet and can confirm the fix?

Sylv___ 66 Reputation points

2022-11-30T17:22:39.833+00:00

Nicelly seen !! I just installed it and it worked !
I did a Test-ComputerSecureChannel -Repair just in case ! (not sure if i had to do it or not, but after 1 restart it still didn't worked, I had the TGT listed but impossible to reach any sysvol share)

Thank you for keeping me updated of the fix !

Christopher Wolf 11 Reputation points

2022-11-30T20:01:54.863+00:00

We are running 2016 Functional Level with 2019 DC Servers. I can confirm that Identity Protection DC Sensor - Sensor Version6.48.21772 install has resolved our drive mapping issues.

Cristiano S.Alves 0 Reputation points

2024-01-03T17:53:48.5333333+00:00

I think it has nothing to do with antivirus or firewall. I am facing exactly the same problem here and it is certainly a problem with Windows updates. At first it was possible to deleted lastet updates in 22h2 and 23h2 versions, just delete the updates in the options and restart the computer to have it working again with samba4 domain. However something really weird is happening now. When I delete the updates and set windows updates as off, when I restart the computer it updates anyway and I can never remove them. I tried remove with powershell since there is a possibility to do so but nothing seems to work anymore. Windows 11 just keep resulting in "trust relationship between this workstation and the domain fails".

I think I have tried everything that was possible. Update samba version, enable and disable Kerberos DES options in Local policies. The only way to login to the domain is using a different Windows version like 7 or 10 which works perfectly. Problem is that all licences here is for Windows 11.

Hope Microsoft fixes it soon.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

17 additional answers

SPembo 6 Reputation points

2022-11-09T17:41:58.297+00:00

As I've been facing this myself and spent the day on it and there doesn't seem to be much information around.

Would any of you be facing issue soely on sites with RODC, as adding the machine to the password replication policy of the RODC 'might' have resolved for me. Too early to confirm, but i appear to have one working this way. We've 3 sites and only facing it on the one, this the only one with the RODC as a factor.

I'm also only so far facing it on machines on Win 11 22H2
Please sign in to rate this answer.

1 person found this answer helpful.
nleva 126 Reputation points

2022-11-09T17:52:37.243+00:00

We don't have RODC. So far the only workaround we've found is to downgrade to Windows 11 21H2.

Nathaniel Rose 1 Reputation point

2022-11-09T17:57:21.073+00:00

No RODC in our environments either.

Michael Domer (TQL) 0 Reputation points

2023-04-28T13:59:44.9466667+00:00

We are seeing this with RODCs. the trust relationship shows broken, but users can logon. the only thing we have seen as a failure is that the clock reverts to Local CMOS and then gets out of sync till Kerberos fails. as stated adding the computer accounts to the RODC Cache fixes it, but this problem didn't exist before 22H2.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Samy Abdellatif 6 Reputation points

2022-11-15T09:15:50.547+00:00

I faced the same problem, do not have crowdstrike !! I'm using simple NAS Synology Directory Server (Samba), just to control access on a file server, no group policy management, I faced this with two windows devices, was running well till the 22H2 update, I have tried removing the device from the domain, deleting it from the active directory computers, tried with same user, different users, it seems the device and DC are talking different languages now.

hope someone come up with solution or workaround
Please sign in to rate this answer.

1 person found this answer helpful.
nleva 126 Reputation points

2022-11-15T15:53:02.717+00:00

If you don't use Crowdstrike falcon identity on your domain controllers, this may be a separate issue. Did it start after the November windows updates? If so, it may be the known issue that was posted for the November updates https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-22h2#2953msgdesc
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Cameron 6 Reputation points

2022-11-15T21:43:30.553+00:00

This is pretty ridiculous. I've been having this issue since updating with 22H2. The only way I can access my account is by disconnecting my internet every time and logging in with saved cached passwords. How does Microsoft release a major update that majorly ruins a lot of peoples systems?

I've tried accessing our AD and changing my password, but that has not solved anything other than a notification that says I need to lock and unlock to give windows my new password - but of course this doesn't work and I have to keep disconnecting my internet, logging in, then reconnecting.
Please sign in to rate this answer.

1 person found this answer helpful.
Nathaniel Rose 1 Reputation point

2022-11-15T21:50:30.85+00:00

You did read the rest of the thread, yes? Are you by chance a Crowdstrike customer because so far majority (all?) of the others in this thread were and found it related to the Crowdstrike sensor on the Domain Controllers. A fixed version has been released for the unified version but not the separated version yet.

Christopher Wolf 11 Reputation points

2022-11-30T20:14:21.537+00:00

CrowdStrike released Identity Protection DC Sensor - Sensor Version 6.48.21772 just recently. It has resolved our issues.

Anonymous

2022-12-16T20:14:36.317+00:00

Thanks Cameron,

You litteraly saved me from reinstalling Windows.

I have the same issue, can no longer login to Windows since update 22h2 done at december 15 (one month later than Cameron answer!)
Not using "Crowdstrike" but an old Active Directory server (LDAP) on the local network.

Disconnecting my ethernet cable is now my only known way to login.

Wifi connection have an option to turn it Off, the same option for ethernet would be nice instead of phisically unplugin the cable.

Nathaniel Rose 1 Reputation point

2022-12-16T20:21:01.81+00:00

If you are actually experiencing the issue described in this thread than yes - Crowdstrike Falcon is at the root of the issue (otherwise it's something else). That said, be very wary of "unplugging ethernet to log in" as that fix is only going to last as long as your password expiring at which point you'll be locked out for good.

Anonymous

2022-12-19T14:16:33.467+00:00

My hope was that this login glitch would disappear by itself soon or later.
This morning my login appears to be working normally !

So this is closed for me.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
JimmySalian-2011 42,156 Reputation points

2022-10-14T11:11:35.777+00:00

Hi,

Do you have any local firewall or any AV that might be blocking the connections, please check the firewall policies and connectivity and also VPN software?

Hope this helps.
JS

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Windows 11 22h2 Problem with Active directory after update

17 additional answers

Your answer