Windows 11 unauthenticated Network

local_stone · 2025-03-31T14:27:23.869Z

Hello guys,

I have a problem which is making trouble. I am currently updating some Clients to Windows 11 and I have the Problem that my network is set as private on 8 of 10 Windows 11 Domain Clients, all 24H2.
I have testet a lot, delayed Start of NLA, disabling ipv6 (we dont have ipv6).

The only Things I can see in the Eventviewer are following:

5719 NETLOGON
This computer was not able to set up a secure session with a domain controller in domain DOMAIN due to the following:
An internal error occurred.
This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

26884 Schannel
The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is client.wns.windows.com. The TLS connection request has failed. The attached data contains the server certificate.
The SSPI client process is svchost[WpnService] (PID: 6380).
This computer was not able to set up a secure session with a domain controller in domain ERNST due to the following:
An internal error occurred.
This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

8020 DNS Client Events
The system failed to register host (A or AAAA) resource records (RRs) for network adapter
with settings:

       Adapter Name : {326FA29C-901E-44B1-XXXX-DA66DCD9841E}
       Host Name : XXXXXXXX
       Primary Domain Suffix : XXXX.XXXX
       DNS server list :
         	XX.XXX.XXX.XX, XX.XXX.XXX.XX
       Sent update to server : <?>
       IP Address(es) :
         XX.XXX.XXX.XXX

The reason the system could not register these RRs during the update request was because of a system problem. You can manually retry DNS registration of the network adapter and its settings by typing ‘ipconfig /registerdns’ at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information.

The last one was quite Interesting but I didnt find out why

Rod-IT · 2025-03-31T14:58:57.467Z

local_stone:

I have a problem which is making trouble. I am currently updating some Clients to Windows 11 and I have the Problem that my network is set as private on 8 of 10 Windows 11 Domain Clients, all 24H2.

W11 24H2 is riddled with issues, you should have held off.

What are the DNS settings used by the client - they should not be showing as private unless you have something like Google DNS as their DNS (which is wrong).

Active Directory DNS Refresher - Windows - Spiceworks Community

The client should use ONLY your DCs for DNS and nothing else.

local_stone · 2025-03-31T15:17:02.472Z

I tested it with a device which has 23h2 installed. same problem.

Sorry the DNS Settings are both DC’s
And yeah it was publuc network not private sorry for that. I manually changed it to private at one of the clients to see if it changes something

Rod-IT · 2025-03-31T15:57:40.471Z

If the network shows as either public (bad) or private, you have something wrong with DNS.

Can you share the output of an ipconfig /all from a client device.

Can you also confirm what your DCs IP are

local_stone · 2025-03-31T16:15:46.305Z

Tomorrow i can share the information with you

spiceuser-ulzq · 2025-03-31T19:19:14.881Z

This worked well for the “Unauthenticated” network issue that caused the device to be on the “public” instead of the “domain” network. Network Location Awareness service revisited – Glennopedia

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters
Add a DWORD value and name it AlwaysExpectDomainController
Set the value to 1
Reboot the server

The other thing that may help is having the network switch immediately start passing traffic instead of doing it’s “initialization” before passing traffic. Sorry I don’t remember the setting on the switch’s. I think that delay may cause the “a domain controller could not be found” error because it is still initializing the port in the switch and the server is trying to look for the domain and then times out before finding one thus causing the computer to be on “Public” instead of “Domain”. On “Public” the computer blocks traffic from the server/domain so no communicating with WSUS or other servers properly.

Also these registry settings may help: Network location awareness not detecting domain network from offsite location - Microsoft Q&A

local_stone · 2025-04-01T06:32:27.089Z

Here are the Information and the both Domain Controllers are: 10.111.100.33, 10.111.100.34

Ethernet adapter Ethernet 3:

Connection-specific DNS Suffix . : testop.intra
Description . . . . . . . . . . . : Realtek USB GbE Family Controller #2
Physical Address. . . . . . . . . : C8-5A-CF-97-37-03
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.111.5.64(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.248.0
Lease Obtained. . . . . . . . . . : Monday, March 31, 2025 3:52:21 PM
Lease Expires . . . . . . . . . . : Friday, April 4, 2025 8:18:19 AM
Default Gateway . . . . . . . . . : 10.111.7.254
DHCP Server . . . . . . . . . . . : 10.111.100.33
DNS Servers . . . . . . . . . . . : 10.111.100.33
10.111.100.34
Primary WINS Server . . . . . . . : 10.111.100.34
Secondary WINS Server . . . . . . : 10.111.100.33
NetBIOS over Tcpip. . . . . . . . : Enabled

local_stone · 2025-04-01T12:21:18.234Z

@Rod-IT Ive resetted the Network Adapters. Now the network is showing authenticated but still public network. Any Ideas?

Rod-IT · 2025-04-01T12:30:31.831Z

testop.intra isn’t a recommended domain suffix.

255.255.248.0 - are you running a supernet of over 2000 IPs? Why so large?

if a non-connecting client pings testop.intra what does it reply with?

WINS shouldn’t be needed these days unless you’ve some major old kit on your network.

Can machines in the domain ping testop.intra?

What does nslookup testop.intra reply with?

Your DHCP scope is 5 days?

local_stone · 2025-04-01T12:47:48.694Z

testop.intra isn’t a recommended domain suffix.
Yeah, I didn’t build the network

255.255.248.0 - are you running a supernet of over 2000 IPs? Why so large?
350 Clients, everyone with 2-3 MACs so I think bc of that.

if a non-connecting client pings testop.intra what does it reply with?

One of the domain Controllers, random as it should be I think

WINS shouldn’t be needed these days unless you’ve some major old kit on your network.

Yeah I dont know if we are using it either.

Can machines in the domain ping testop.intra?
Yes

What does nslookup testop.intra reply with?
All DC’s

Your DHCP scope is 5 days?
Yes I think so

Sorry If i cannot answer some Questions. Im relatively new .

Its strange: 1 of the 9 Win 11 Clients says domain network, all other public…

Rod-IT · 2025-04-01T13:11:39.240Z

local_stone:

Sorry If i cannot answer some Questions. Im relatively new

You’re doing fine, but your peers should be assisting you too, they’re there to guide you.

local_stone:

255.255.248.0 - are you running a supernet of over 2000 IPs? Why so large?
350 Clients, everyone with 2-3 MACs so I think bc of that.

Why do people have 3 MAC?

Either way, VLANs and subnets exist, your company should look to add them to add a layer of security. Having one large subnet, while it works is a massive broadcast domain.

Do the machines have any other firewalls or third party software on them that may get in the way of their network setup?

If you look in AD, DHCP and DNS, do you see the devices ok?

general-tsao · 2025-04-01T13:34:12.931Z

There are network issues with both Windows 11 23H2 and 24H2, I’ve experienced both, much more so with 24H2…if you have Windows 10 clients working in this network, you really have to rule out issues with the OS before you go down the network rabbit hole that may prove futile.

local_stone · 2025-04-01T13:44:00.410Z

Rod-IT:

You’re doing fine, but your peers should be assisting you too, they’re there to guide you.

They are all sick

Rod-IT:

Why do people have 3 MAC?

WLAN, LAN, Dockingstation (USB-C, No Passthrough)

Rod-IT:

layer of security. Having one large subnet, while it works is a massive broadcast domain.

We have a NAC and our network is completely segmented and we have over 80 VLANS

Rod-IT:

other firewalls or third party software

Yes indeed. We use sophos Intercept X

kwelch007 · 2025-04-01T13:55:21.817Z

local_stone:

8020 DNS Client Events
The system failed to register host (A or AAAA) resource records (RRs) for network adapter
with settings:
       Adapter Name : {326FA29C-901E-44B1-XXXX-DA66DCD9841E}
       Host Name : XXXXXXXX
       Primary Domain Suffix : XXXX.XXXX
       DNS server list :
         	XX.XXX.XXX.XX, XX.XXX.XXX.XX
       Sent update to server : <?>
       IP Address(es) :
         XX.XXX.XXX.XXX
The reason the system could not register these RRs during the update request was because of a system problem. You can manually retry DNS registration of the network adapter and its settings by typing ‘ipconfig /registerdns’ at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information.

This is likely your problem. Did you try the “ipconfig /registerdns” command on a client in an Administrator command-prompt? Do the previous (Win10 or earlier PCs) have DNS entries manually entered in to DNS versus self-registered names?

Are these PCs being assigned IP addresses via DHCP, or are they manually configured? If DHCP, in the DHCP configuration on your Domain is the "“Enable DNS dynamic updates according to the settings below” enabled for the client scope?

Rod-IT · 2025-04-01T14:23:12.915Z

local_stone:

we have over 80 VLANS

Then the large subnet above makes no sense, even if users did need 3 mac addresses, which they don’t. At least not at the same time.

Reduce your DHCP from 5 days to 8 hours or less and DHCP will handle multiple macs on a smaller subnet. It’s unlikely they will be switching between wired, wireless and the dock multiple times in the day.

All our clients use WLAN only these days, with very few wired.

local_stone · 2025-04-02T06:25:40.050Z

kwelch007:

Are these PCs being assigned IP addresses via DHCP, or are they manually configured? If DHCP, in the DHCP configuration on your Domain is the "“Enable DNS dynamic updates according to the settings below” enabled for the client scope?

Yes I checked and it is set to “Enable DNS dynamic updates according to the settings below” for the client scope.

I also can see with wireshark that the LDAP connection is successful, wich is also used for determining the network type i think.

But here is the funny thing: I completely resetted the network adapters and now it doesnt shows unauthenticated anymore BUT it is still shown as public network.

Last Thing i could see was the following:

image379×173 3.65 KB

Normally DomainAuthenticationKind Should be Ldap…

thanks!

kwelch007 · 2025-04-02T13:32:57.905Z

Any chance the PC Object is disabled in AD?

local_stone · 2025-04-02T14:17:09.471Z

Nope, Ive tested it with multiple clients. New ones and the ones that got the feature update. With windows 10 it worked before. Same Clients, no config Change

kwelch007 · 2025-04-02T14:54:08.211Z

Strange. As others have said, 24H2 and even 23H2 are known to have some bugs particularly with networking.

Out of curiosity, what version of Windows Server are your DCs?

local_stone · 2025-04-02T15:06:47.106Z

Server 2019