Incorrect password during Windows login (AD) after waking from sleep mode

Question

For several months now, users have been encountering a problem where their AD password is rejected when logging in to their Windows 11 PC. This happens after locking the session or waking from sleep mode.

The password entered is 100% correct, but the system rejects it.

We have two domain controllers, one running Windows Server 2016 and one running Windows Server 2025. We have no logs or events on any of the DCs when the problem occurs, not even in the user or PC attribute editor.

We have already disabled Windows standby and network cards, but this has not changed anything.

One of the solutions we found that works half the time is to change networks (Ethernet -> Wi-Fi and vice versa). The only solution that always works is to restart the PC.

When the problem occurred, we were able to confirm that:

the PC time is correct

the NL test is OK

SecureChannel is OK

We don't know where else to look for the problem or how to solve it.

Thank you for your help.

Answer 1

The issue you are experiencing with users being unable to log in to their Windows 11 PCs after waking from sleep mode could be related to several factors, especially considering that the problem occurs in an Active Directory (AD) environment. Here are some troubleshooting steps and considerations:

1. Network Connectivity: Since changing networks (Ethernet to Wi-Fi and vice versa) sometimes resolves the issue, it suggests there may be a network-related problem. Ensure that the network connection is stable and that there are no intermittent connectivity issues when waking from sleep.
2. Secure Channel Issues: Although you mentioned that the SecureChannel is OK, it might be worth rechecking the secure channel status. You can run the command nltest /sc_verify:<DomainName> to confirm that the secure channel is functioning correctly.
3. Time Synchronization: You confirmed that the PC time is correct, which is crucial for Kerberos authentication. Ensure that all domain controllers are synchronized with the same time source.
4. Group Policy Settings: Review any Group Policy settings that might affect logon behavior after sleep. There may be policies that impact how credentials are cached or how the system interacts with the domain during wake events.
5. Event Logs: While you mentioned there are no logs or events on the DCs, check the local event logs on the affected PCs for any warnings or errors related to authentication or network connectivity around the time the issue occurs.
6. Power Management Settings: Since disabling Windows standby and network cards did not help, ensure that the power management settings for the network adapter are not set to allow the computer to turn off the device to save power.
7. Testing with Different User Accounts: If possible, test with different user accounts to determine if the issue is user-specific or affects all users.
8. Windows Updates: Ensure that all Windows updates are applied, as there may be fixes related to login issues in newer updates.

If the problem persists after these checks, consider reaching out to Microsoft support for further assistance, as they may have additional insights or updates regarding this specific issue with Windows 11 and Active Directory.

---

References:

• Active Directory has a newer password value than the client device
• Can't sign in to a domain controller, and the LSASS process stops responding