Windows 11 Client can't join the domain

UCS - Univention Corporate Server
, , , ,
#1

Hello there!

I ran into a problem today. Installed Windows 11 on a computer and tried to join it to the domain. It throws an error:

“Wrong username or password” after a few tries, i used the powershell command to join to the domain. same username and password. worked. rebooted and tried to login via domain user. same error: “wrong username or password”.

Network is working fine. We can use all local websites and can login with domain credentials on the websites. DNS-Server are setup right too. DNS-Suffix is right too. NetBios settings(WINS) for ipv4 is on default.

Only thing that is different from the other working clients is the dns forward zone entry

Not working one:

image

Working one:

image

How can i change this entry? or where is it saved?

Univention Version: 4.4-9 errata1279

#2

I don’t think, this is related to the DNS Entry. Microsoft cut some older Hashing Algorithms for Kerberos in 22H2. If the PC is working well in the domain, after Upgrading to 22H2, the mentioned behaviour can be seen. Deinstalling 22H2 and reverting to 22H1 “solves” the problem. I think your freshly installed Windows 11 is at the same patch-level, so the problem occurs.

#3

You have two options really:

  • upgrade Univention to version 5.0-2 which contains Samba 16.2 which will co-operate happily with Windows 11 22H2

  • downgrade Windows 11 to 21H2

There is a hackey workaround to change the way Kerberos works on Windows which will allow you to login, however, you will find that Group Policy updates and who knows what else won’t work.

There is a rather interesting thread on the matter here:

#4
Mastodon