Share via

Anyone else have a problem with .NET function GetAllTrustRelationships() after KB5009557?

Paul Adams 41 Reputation points
2022-01-18T18:46:20.747+00:00

I ran into an issue with a Citrix service (Citrix PVS Streaming Server) failing to start after KB5009557 was installed in my environment - it would crash with a .NET access violation when enumerating the forest trusts, which it has never done before.
Removing the update from my (2019) DCs appears to be a workaround, but as it is a cumulative update it is clearly not a solution.

Citrix have a registry value which skips the forest check on startup (even for the management tools), but I can reproduce the access violation with 3 lines in PowerShell (and no 3rd party modules):

Add-Type -Path "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll"
$forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$forest.GetAllTrustRelationships()

This does not happen in all environments, so I am looking into what is consistent in the failing scenarios.
Oddly, it never crashes using the 32-bit powershell.exe.

My environment is basically 1 user forest and 3 resource forests; 2 with a 2-way forest trust and the 3rd a 1-way trust against the user forest.
The trusts themselves are working fine, it would be disruptive to delete & recreate them, and I was not able to reproduce the issue in a lab with 3 new forests.

Using an account in the user forest to execute the code triggers the exception, even without KB5009557.
Using an account in the local resource forest triggers the exception if KB5009557 is installed on the DCs.
This is true for the user forest and 2 of the resource forests - in the 3rd resource forest either account works without an exception.

So I am interested to know if anyone else out there with at least 1 forest trust gets the same symptom as me?
(Get-ADTrust works fine, but that uses ADWS instead of .NET.)

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Developer technologies | .NET | .NET Runtime
Accepted answer
  1. Barclay, Michael 86 Reputation points
    2022-02-06T08:34:10.49+00:00
    2 people found this answer helpful.

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jasper Meyer 6 Reputation points
    2022-02-04T08:49:23.927+00:00

    We, more exactly at least two of our customers, experienced that issue, too.
    Our software (64 bit, hosted in IIS) tries to get the trust relationships at some point and there it crashes the IIS.
    We could recreate the issue in their environments in PowerShell but haven't found another solution than uninstalling the said update.

    Have you found a solution by now?
    I'll update my answer if we find one.

    1 person found this answer helpful.
  2. JoeB 11 Reputation points
    2022-02-06T10:15:21.767+00:00

    Thank you BarcleyMichael-7363 for this Information !

    The OOB-Patch 2022-02 Update for .NET Framework 3.5 and 4.8 for Windows Server 2019 for x64 (KB5011257) Last Modified: 2/5/2022 Size: 360 KB works for us on Windows Server 2019.

    The MS-Catalog-Link for Windows Server 2019 is:
    http://download.windowsupdate.com/c/msdownload/update/software/updt/2022/02/windows10.0-kb5011257-x64-ndp48_7c441c861f85e9a60b9f2c0f58aeb13a040e3659.msu

    Great Job
    Greetings

    1 person found this answer helpful.
    0 comments
  3. Sébastien Lagueux 31 Reputation points
    2022-02-04T13:21:29.717+00:00

    Same problem here! Please help!

    0 comments
  4. Sébastien Lagueux 31 Reputation points
    2022-02-04T16:10:38.6+00:00

    I fixed it by removing/moving ALL users not in the same domain as management server is a member of. Hope this will be a fix for you as well.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.