Post

Brian Hoyt
@hoyty.com

Hi @syfuhs.net hoping you might be able to help me with weird problem in your area of expertise. Recently we have been getting "incorrect password" issues on login. In all cases the password hasn't been changed. We are 11 24H2 and mix of 2022/25 domain controllers. I can't reliably repro the issue.

0 reposts2 likes

Brian Hoyt
@hoyty.com

If we disable network and used cached credentials to login it works. It appears to be random and rarely happens to same user multiple times. It is a small K-12 school network with about 300 devices and 3 local AD DC. Any suggestions on where to investigate highly appreciated.

Steve Syfuhs
@syfuhs.net

Are you seeing account lockouts correlating with the failures? We had a bug on the 2025 side that's incorrectly incrementing the counter if it gets the N-1 password. That's in the process of getting patched.

Brian Hoyt
@hoyty.com

Thanks for the reply. No lockouts that we have seen. We aren't doing anything to "fix" the problem other than working around the actual online login process by disconnecting the device. Then the problem just goes away. Sometimes restarting the client device helps and other times it doesn't.

Steve Syfuhs
@syfuhs.net

Off the top of my head I can't think of what would otherwise trigger that. It's certain weird. Network trace to see what's going across the wire when it fails would be interesting. Alternatively enabling kerberos logging to see if anything pops in the event log.