Forum Discussion
W11 24H2 - Trust relationship breaking with hybrid-joined machines
Has anyone else encountered the issue whereby when the 24H2 update installs on a hybrid-joined machine (Intune / local AD), the trust relationship with the local AD becomes broken, and the only way to log into the machine is using a local admin account (if one exists), and then repair the trust using the Test-ComputerSecureChannel -Repair command?
It seems to happen consistently with all our hybrid-joined machines immediately after the update has installed.
Note on my post. I forgot to mention the server and my PC's are all in a Workgroup, not a domain.
Well, for what it's worth, here's my saga. At home I have a Windows 11 24H2 Home PC. I also have a Window Server Essentials 2012r2. Everything has been fine, almost. This PC and the others use the Essentials Connector to connect to the server for daily backups and file sharing. I had been having stability issues with my W11 PC so a week ago I did an in-place installation of Windows 11 24H2 to resolve the stability problems. The in-place installation was successful and everything worked except for the Connector application. I uninstalled it and every time I attempted to reinstall it I would get to a point after I entered my credentials where it said, "This computer is unable to establish a trust relationship with the server. Verify that the computer's date and time are accurate and try again." Over two days I did a ton of research trying lots of things, but nothing worked. Over the next three days I worked with MSFT support in the Windows group, and they couldn't figure anything out either. Just as a test, I took my Surface Pro with the same exact build of Windows 11 Home with 24H2 with a functioning Connector, uninstalled the Connector and tried to reinstall it. Same exact error message. Then I saw these comments. Now, I have to wait for Microsoft to fix this. Hopefully my input is helpful.
I bet someone at Microsoft is sweating right now. They're probably huddled in a room, fueled by Red Bull and desperation, trying to figure out why their update is playing trust-buster. Probably blaming each other, saying things like, "Well, you were supposed to test that!" and "It worked in my environment!"
Is there any news on this issue? Unfortunately, we are currently blocked in our company with the Windows 11 migration. There is still no solution from Microsoft Support. There are only 8 months left until October 14, 2025 and we have almost 2000 Windows 10 upgrades pending.
While not ideal, you could upgrade to 23H2 instead. We have not experienced any of these issues on the older build. In the meantime we have used a GPO to prevent any further machines from upgrading to 24H2. I am about three weeks into a Microsoft case about this issue and so far no closer to a solution unfortunately. My fear is that they will suggest upgrading our DC's to Server 2025 but my team does not have the resources for that sort of undertaking this year.
We have the same problem with in-place upgrade from Windows 10 to Windows 11 24H2. Interestingly, it does not affect every in-place upgrade. Out of about 50 upgrades, I have the problem 3 times. Unfortunately we have not found a workaround either. Does anyone have a workaround? Today I also opened a ticket with Microsoft.
Yes we have this issue too. After a restart we are seeing NETLOGON errors 5719 and 5720. It also seems to be affecting NTP via Time-Service error 130 when attempting to communicate with our DC.
This is happening for both new deployments and in-place upgrades from 11 23H2. Machines on 23H2 do not have these errors.
Yes we have, whether an in place upgrade or a fresh 24H2 Image install.
What we have found is the Netlogon Service is not able to connect/authenticate with our domain controllers. You can easily test this by stop/starting the netlogon service then check the System event logs and you should see the event 5719 failure.
We have an open support ticket regarding the issue, hopefully we come to a solution soon. In the meantime we have put a halt to 24H2 installs in our environment.I have done upgrades from windows 10 to windows 11 24H2 being hybrid joined.
I always ask to much information but better to much then to less.
- What OS and version where the device running before the upgrade?
- Are all updates installed before the upgrade?
- What brand, model and what kind of device? (laptop, desktop, tablet,..)
- Do you see anything in the logs check the Netlogon logs
- Can you join a clean installed windows 11 24h2 device to your domain without any issue?
- Are there devices that do not have this issue, if so what are the differences between them?
