October update, Windows 11 24H2, issues authenticating

Hi Daniel Kaliel,

So for late reply. How are you, how is everything? Have you solved the problem yet? As you mentioned, what we’re seeing is tied to the stricter Kerberos/NTLM enforcement introduced in the October 24H2 update. When users unlock their machines off‑network (before VPN is established), Windows now attempts Kerberos first, denies NTLM per your current policy, and only then falls back to cached credentials, which results in multiple failed attempts before a successful unlock.

To confirm, you could temporarily switch NTLM restrictions from Deny to Audit on a test device and see if unlock succeeds immediately. For longer term, you can try enabling pre‑logon VPN or adjusting NTLM restrictions to allow smoother cached logon.

Vivian

Good morning Daniel Kaliel,

Have you been able to solve the issue yet? If not, is there anything I can help you with? Please let me know.

If everything is fine, would you mind sharing your experience with the issue by accepting the answer so that it could be spread further to those in need too? Thank you :)

Vivian

Then it might have been the fact that Microsoft hardened Kerberos and NTLM authentication flows, which has introduced new failure modes even on properly imaged, unique machines. The login issue of yours is probably related to Kerberos ticket acquisition failures caused by stricter channel binding and PAC validation.

If it's the case, the fix is to ensure all DCs and clients are patched consistently, reset secure channels on affected machines, collect Kerberos logs to confirm whether PAC validation or channel binding is failing, and the last resort is to wait for a permanent fix to be released.

If you find this information useful to some extent, please accept the answer so that your experience with the issue would help contribute to the whole community. Thank you :)

Vivian

Hi Daniel Kaliel,

Even if you have no duplicate machine SIDs, the new enforcement can cause repeated domain logon failures if there are stale machine accounts, mismatched secure channel states, or improperly generalized images.It's has been raised by other people and is recommended to re‑image improperly prepared devices or repairing trust relationships.

You can read more from this: https://support.microsoft.com/en-us/topic/kerberos-and-ntlm-authentication-failures-due-to-duplicate-sids-76f7394d-c460-4882-9ed1-d27e0960f949

If you find this information useful to some extent, please accept the answer so that your experience with the issue would help contribute to the whole community. Thank you :)

Vivian