Server 2025 Core ADDS DC, Network Profile Showing as "Public" and not as "DomainAuthenticated"

Anything having to be done to the OS besides installing it out of the box for this feature to work properly is a "hack". No bandaids - even adding an IPv6 address should be required for this to work. It isn't in Server 2022. This should just work out of the box. By the way, in testing, demoting the server back to a member server returns the network adapter operation to normal. That's why I am convinced this has something to do with them removing the dependency on NLA, however, keeping the requirement as part of AD for some reason when the server becomes a DC. Guessing something wasn't coded properly. I hope to hear back from MS at some point on this.

Found this issue as been testing Server 2025 and noticed the Network Location Awareness service is set to Manual, not Automatic. Nothing is documented about this change in the services I can find.

Hello everyone, I had a little time over the weekend to try out a few things again and finally came up with a way that allows me to get to the domain firewall profile (even after a restart) without any major ‘hacks’.

1.) It is important that the server that receives the AD role is assigned an IPv6. 

2.) Furthermore, the DWORD AlwaysExpectDomainController must be created in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters and set to 1.

Before I forget, it is normal that the NLA service with version 2025 no longer has any dependencies or is now set to manual. The correct firewall profile is still assigned.

Maybe this will help someone. 

If everyone could go into Feedback Hub in the settings of 2025, and explain this. Strength in numbers. I also have an open case with them that they have escalated to the product team. I have had this case open even since the pre-release. They took lots of captures, and logs, in both the failed states and after restarting the NIC. They thought my scheduled task to restart the NIC at boot up was clever. Yea, it works, but it's not clean and native and they understand this is not a true workaround or fix. There is light at the end of the tunnel as they were able to reproduce this issue in their lab. 

This is not listed in the official Microsoft Windows Server 2025 known issues:

https://learn.microsoft.com/en-us/windows/release-health/status-windows-server-2025

Microsoft clearly has no interest in fixing this. They only seem to be interested in what affects their cloud services or for what that they can charge a monthly subscription for.

Or maybe they are not even aware of this bug due to their incompetence and ineptitude. 

I wanted to set up a new AD with 26100.2033 today and almost despaired because of the wrong firewall profile. The NlaSvc service doesn't seem to be set to automatic after installing the Windows AD role. I really wonder who tests these builds before releasing them, it really only helps to restart the network adapter so that the correct domain firewall profile is loaded, setting dependencies for the NlaSvc service no longer works either.

It still plagues Version 10.0.26100.2033

The production release of the ISO still has this problem. Microsoft has escalated with their engineers, however, it still went RTM with this issue when you make it a DC. Any other server, probably fine to deploy, especially Hyper-V with all the good stuff that brings, like GPU pools, but don't make it a domain controller, unless you put that "bandaid" mentioned above in place.

DarienHawkins 

Unbelievable this is still an issue in the final build 26100.1742. I upgraded 2022 DCs in two different domains to 2025 and all of them have the public firewall profile set unless/until I disable/re-enable the nic.