Invalid Password after promo/depromo a Server 2025 DC.

Hello Karker, Bradley- GA

Netlogon errors on a newly promoted Server 2025 DC usually point to secure channel or encryption mismatches. Since RC4 is deprecated, older clients or servers still attempting RC4 negotiation will intermittently fail with “password invalid.” Check the Netlogon logs in Event Viewer for events 5829–5831 to confirm secure channel negotiation failures. Run nltest /sc_verify:<domain> from affected machines to validate the secure channel. If failures persist, reset machine account passwords with netdom resetpwd and confirm replication health using repadmin /replsummary.

On Server 2025, ensure all DCs and clients are aligned to AES-based encryption policies, as RC4 is disabled by default. Review Group Policy under Security Options for domain controller encryption settings, and confirm no legacy policies are forcing RC4. If depromo resolved part of the issue, replication or trust was broken on that DC, so verify consistency across the forest. If errors continue despite alignment, it may be a bug in the preview build, and monitoring Microsoft’s release notes for fixes is the safest path forward.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Harry.