windows server 2025 join domain failed

[Zhangyufan]

I have a test lab with ONTAP simulator at 9.13.1 version, and Microsoft published windows server 2025 last month, so I want test ONTAP with new OS.

1.Windows server 2025 is installed and active directory service is installed.

2. During the cifs create procedure, it shows an error: Machine account creation procedure failed.

3. From wireshark capture, it shows kpasswd replyed an error.

[liu]

The user account in this kb used to add a computer account is using an incorrect password 

Machine Account Creation Procedure Failed - KRB5KDC_ERR_PREAUTH_FAILED - NetApp Knowledge Base

Or the user credentials are incorrect   Machine account creation procedure failed with KRB5_REALM_UNKNOWN error - NetApp Knowledge Base

[CristianoRossi]

If you check Interoperability Matrix for CIFS, Windows 2025 Server is not yet listed, so the validation is not executed yet. 

The error is pointing to a duplicate/reused account on Domain Controller for the SVM.

Please retry posting the full secd log for cifs create call to understand the reason for the failure

[Zhangyufan]

thanks your reply, I don't know how to collect full secd log, bellow is what I collected logs.

ontap_913::*> event log show -node ontap_913-01 -event secd*
Time Node Severity Event
------------------- ---------------- ------------- ---------------------------
12/5/2024 01:34:17 ontap_913-01 ERROR secd.unexpectedFailure: Unexpected SecD failure in Vserver "svm_s3". Details: Error: Machine account creation procedure failed
[ 8142] Loaded the preliminary configuration.
[ 8216] Created a machine account in the domain
[ 8219] SID to name translations of Domain Users and Admins completed successfully
[ 8220] Successfully connected to ip 8.47.176.15, port 88 using TCP
[ 8223] Successfully connected to ip 8.47.176.15, port 464 using TCP
**[ 8298] FAILURE: Kerberos password set for 'NETAPP2$@WIN2025AD.COM' failed with Message stream modified (KRB5KRB_AP_ERR_MODIFIED)
[ 8313] Deleted existing account 'CN=NETAPP2,CN=Computers,DC=win2025ad,DC=com'
[ 8313] Retry requested, but the retry window (7000 ms) has expired; giving up.
12/5/2024 01:34:08 ontap_913-01 NOTICE secd.conn.auth.failure: Vserver (svm_s3) could not make a connection over the network to server (ip 8.46.176.15, port 389). Error: Network is unreachable (Operation: AnonymousBind).

[CristianoRossi]

It seems there is a problem on Microsoft side for kpasswd (Kerberos password change service) and it is investigated by Microsoft at the moment. 

[HansThoren]

Any updates to this problem? The suggested work arounds selecting a different preffered DC only works for already domain joined SVM´s.

[CristianoRossi]

Unfortunately we have to wait for Microsoft to provide a fix

Preferred DC and discovery modes can be set even before cifs server creation (like the security settings)

[adrian_sotillo]

There are people reporting that in WS2025 September update this kpasswd bug might be resolved (see https://gitlab.freedesktop.org/realmd/adcli/-/issues/40).

Could that mean that this problem (also described in https://kb.netapp.com/on-prem/ontap/da/NAS/NAS-Issues/CONTAP-347583) has been finally resolved?