# What Breaks When Domain Controllers Move to Windows Server 2025: SMB Signing, NTLMv1, Kerberos and Certificate Mapping, and the Equipment That Stops Authenticating

> Which Windows Server 2025 defaults break older NAS, scanners, Linux hosts and LDAP apps after a domain controller upgrade, how to find them, and the fix.

Canonical: https://o365hq.com/blog/what-breaks-when-domain-controllers-move-to-windows-server-2025-smb-signing-ntlm-kerberos-equipment
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-10-18 · IT Partner

A Windows Server 2025 domain controller refuses what a Windows Server 2016 one accepted: NTLMv1, SMB1, unsigned outbound SMB, RC4-only Kerberos, certificates without a strong mapping and, by the end of the project, unsigned LDAP. Here is what breaks first, how to find it before the cutover, and what to do with the device that cannot be fixed.

## The five defaults that changed, and what notices them first

Two of the five changes are the operating system's: NTLMv1 is removed, outbound SMB signing is required, SMB1 is not installed and DES is removed. The other three arrive through monthly updates on every supported domain controller version, Windows Server 2016 included, and cannot be switched back: at the time of writing, Microsoft has removed the registry keys for PAC validation (April 2025), certificate mapping (September 9, 2025) and the RC4 default (July 2026). "Our NAS, scanners, Linux servers and lab equipment can't connect" is therefore never answered by a domain-wide setting; it is a per-device fix, an exception or a replacement, planned inside the [order of operations for replacing the domain controllers](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations) before Windows Server 2016 leaves extended support on January 12, 2027.

| Default | Windows Server 2025 behavior | What notices it first |
|---|---|---|
| SMB signing and SMB1 | Signing required on every outbound connection, ending guest access; SMB1 not installed; Windows 11 24H2 Enterprise, Pro and Education require it both ways | Backup jobs to an older NAS; guest shares; SMB1-only equipment |
| NTLMv1 | Removed; NTLMv2 and Kerberos only, NTLM use audited | Scan-to-folder printers, older NAS firmware, embedded Windows, VPN with MS-CHAPv2 |
| Kerberos | PAC validation enforced; accounts with no explicit encryption-type attribute AES-only since April 14, 2026; DES removed | Old service accounts, Linux hosts with RC4-only keytabs |
| Certificate mapping | Full Enforcement: the SID extension or a strong altSecurityIdentities mapping; no compatibility mode since September 9, 2025 | Smart-card sign-in, 802.1X and VPN certificates through NPS, unpatched certification authorities |
| LDAP signing and channel binding | Required by default on new Active Directory deployments, with the enforcement policy on; an existing forest keeps its policy setting; channel binding audited (events 3074 and 3075) | Simple binds on 389: ERP connectors, badge systems, lab software, appliances bound to one domain controller |

## The equipment that usually breaks, by category

Older NAS appliances. A new laptop or a backup job from a 2025 server is refused: SMB1, NTLMv1 or no signing. Update the firmware to SMB2 or SMB3 with signing and NTLMv2, or move the data and retire the box.

Scan-to-folder printers. Scans stop arriving. Firmware fixes supported models; otherwise scan to email, a cloud connector, or a member-server share, never a domain controller.

Linux hosts on SSSD or Winbind. Logins and keytab jobs fail on RC4-only machine accounts. Rotate the machine account password or re-join so AES keys exist, drop RC4 from the permitted types, and keep Samba at SMB2 or later, NTLMv2 only.

Embedded Windows or SMB1 equipment. The machine cannot read its program share. Give it its own VLAN, a staging share on a member server with a local account, and a replacement date from the vendor.

LDAP applications bound to a hard-coded domain controller. They work until it is demoted. Bind to the domain's DNS name over LDAPS or a signed bind; keeping the retired IP address on the replacement buys time only.

Service accounts with RC4-only Kerberos. Event 4769 shows encryption type 0x17. Set msDS-SupportedEncryptionTypes to AES, reset the password so AES keys exist, and check for duplicate SPNs.

The ERP sign-in path. Ask the vendor which path it uses, since "all three" is common: Entra single sign-on, untouched while Entra Connect syncs; Kerberos, tied to the service account's encryption type and SPN; direct LDAP, tied to signing and the domain controller named in the connector.

## How to find them before the cutover: a read-only inventory

Every step is read-only. Run it on every 2016 domain controller; applications bind to specific ones.

1. NTLM. Enable "Network security: Restrict NTLM: Audit NTLM authentication in this domain"; events 8001 to 8004 appear in the NTLM/Operational log, and 8004 on a domain controller names client and account. For NTLMv1, filter Security event 4624 for package name NTLM V1.
2. LDAP. Event 2887 in the Directory Service log counts unsigned binds daily. Raise "16 LDAP Interface Events" to 2 for a week and event 2889 names each client by IP address and account; 3039 and 3040, and the 3074 and 3075 audit events, cover channel binding.
3. SMB1. Set -AuditSmb1Access $true with Set-SmbServerConfiguration on each 2016 server and read event 3000 in the SMBServer/Audit log; Get-SmbSession shows each client's dialect.
4. Kerberos. Filter 4769 for encryption type 0x17 and list accounts with service principal names whose msDS-SupportedEncryptionTypes is empty or RC4-only.
5. Certificates. Look for Kerberos-Key-Distribution-Center events 39 and 41 in the System log, and list certificate templates that do not issue the SID extension.
6. DNS. Turn on query logging and filter for the old domain controllers' names; each source IP is a device. [Finding everything that still points at an old domain controller](/blog/finding-everything-that-still-points-at-an-old-domain-controller-before-you-demote) covers DHCP option 006 and static entries.
7. The questionnaire. How does the application find a domain controller: domain name, host name or IP? Which bind: simple, signed, or LDAPS? Which account binds, and when was its password last changed? Kerberos, NTLM or LDAP for user sign-in? Does the vendor support Windows Server 2025 domain controllers in writing?

## The compatibility-testing stage: a pilot domain controller and a test site

The testing stage proves each line of the inventory against a real 2025 domain controller before any demotion. Promote the pilot in the site with the most old equipment, give it no operations master roles, and leave the site's 2016 domain controllers running. Point each test device at the pilot and watch its logs for 2889, 8004, RC4 in 4769 and KDC events 39 and 41 during the test. Add a Windows 11 24H2 laptop to every test; it requires signing both ways and finds the NAS first.

Each category in the checklist below has a pass condition written first and a rollback that fits the step: revert the device; demote the pilot, clean while it holds no roles; point the test site back at its 2016 domain controllers. The only step without a rollback is the schema update, the first gated change in the order-of-operations article; nothing here touches it.

## A worked example: six sites, and a questionnaire that said yes

A hardware manufacturer with six sites on three continents is replacing about ten Windows Server 2016 domain controllers in one forest, one domain, before January 12, 2027. The questionnaire says "yes" to in-house LDAP applications and names none; it lists an ERP and factory and lab equipment on Active Directory, and leaves DHCP blank.

That "yes" is why a compatibility-testing stage is added between the schema update and the first demotion, and why the design is not final until the factory and lab equipment at each site is counted. The inventory runs read-only for a week per site, the pilot goes where the most equipment is, and each application owner tests against it.

Per site the sequence stays promote, demote, then move the retired IP address onto the replacement, so appliances still bound to it keep working until re-pointed. Anything that fails and cannot be updated gets a written exception or a replacement order before the overnight window is booked; Windows Server 2016 ESU is the priced safety valve, not the plan.

## What not to do: weaken the estate to save one device

The reflex when a scanner stops is to lower a domain-wide setting until it works. Most of those settings are gone: NTLMv1 cannot be re-enabled, and the keys that softened PAC validation, certificate mapping and the RC4 default were removed in the April 2025, September 2025 and July 2026 updates. What remains, SMB client signing, LDAP signing policy and RC4 allowances, is what an attacker hopes you will relax estate-wide for one device.

Isolate or replace the device instead, under an exception with five parts: device, owner and reason in writing; the narrowest scope (one account attribute, one certificate mapping, one member server, one VLAN), never a domain controller or a default policy; monitoring that confirms only that device uses it; an expiry date tied to the replacement order; a review on that date.

## What it costs

The [Domain Services and Active Directory Roles Migration](/services/active-directory-domain-controller-migration) service transfers the roles of a single domain controller for $900 per project over three days, sized for one pilot. For one forest with up to six sites and fourteen domain controllers, [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025) runs the whole sequence, testing stage included, from $12,500 over eight weeks. An estate that has never audited NTLM or LDAP starts with the [Active Directory Security Assessment and Hardening](/services/active-directory-security-assessment) at $3,950 per project over two weeks, which produces the device list. Licenses and CALs are covered in [Windows Server 2025 licensing: what changed](/blog/windows-server-2025-licensing-what-changed). If a site slips past January 12, 2027, Windows Server 2016 ESU covers it; that charge, like every Microsoft meter, is billed to you.

## Frequently asked questions

### After upgrading domain controllers to Windows Server 2025 our NAS, scanners and Linux servers can't connect. What changed?

It refuses NTLMv1, does not install SMB1, signs every SMB connection it makes, treats accounts with no encryption-type attribute as AES-only, and rejects weakly mapped certificates; the fix is on the device.

### Which Windows Server 2025 security defaults changed from Windows Server 2016?

Outbound SMB signing, SMB1 not installed; NTLMv1 removed; Kerberos with enforced PAC validation, AES-only by default since April 14, 2026, no DES; certificate mapping in Full Enforcement; LDAP signing required in new forests.

### How do we find the LDAP applications bound to a specific domain controller?

Raise "16 LDAP Interface Events" to 2 on that domain controller; for a week, event 2889 names each client's IP address and account. Match the addresses to DHCP leases and the asset list.

### Can we turn SMB signing or NTLMv1 back on for one device?

NTLMv1 cannot be turned back on. SMB signing can be relaxed on one member server hosting the device's share, never on a domain controller, under a written exception with an expiry date.

### Will our Linux servers on SSSD or Winbind keep working?

Yes, if their machine accounts hold AES keys and nothing pins RC4 or NTLMv1. Hosts joined years ago often do not; rotate the machine account password or re-join, then test against the pilot.

## Compatibility-testing checklist, by category

| Category | Test against the pilot | Pass condition |
|---|---|---|
| NAS appliance | Share from a Windows 11 24H2 laptop; a backup job from a 2025 server | Both succeed with a domain account; no NTLMv1 or SMB1 event |
| Scan-to-folder printer | Scan to the production share | Scan lands; no SMB1 or NTLMv1 event |
| Linux SSSD or Winbind host | Login, sudo with a domain group, one keytab job | AES tickets; no 4769 with type 0x17 |
| Embedded or SMB1 equipment | Read the program share, write a result | Works from its VLAN against a member-server share |
| LDAP-bound application | Bind by domain DNS name over LDAPS or signed | No 2889 entry for its account; a test user signs in |
| Service account with an SPN | Sign in to the application; inspect 4769 | AES ticket; the application accepts it |
| Certificate sign-in, 802.1X, VPN | Sign in with a current-template certificate | No KDC event 39 or 41; mapped by the SID extension |
| ERP path | Each path the vendor named | A test user signs in on each; no warning on the pilot |

## Sources

- Microsoft Learn, "SMB feature descriptions" (windows-server/storage/file-server/smb-feature-descriptions), retrieved October 2026
- Microsoft Learn, "Control SMB signing behavior" (windows-server/storage/file-server/smb-signing), retrieved October 2026
- Microsoft Learn, "SMBv1 is not installed by default in Windows" (windows-server/storage/file-server/troubleshoot/smbv1-not-installed-by-default-in-windows), retrieved October 2026
- Microsoft Learn, "Detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows" (windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3), retrieved October 2026
- Microsoft Support, "Upcoming changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025" (KB5066470, August 2025), retrieved October 2026
- Microsoft Support, "Overview of NTLM auditing enhancements in Windows 11, version 24H2, Windows Server 2019, and later versions" (KB5064479, July 2025), retrieved October 2026
- Microsoft Support, "Audit use of NTLMv1 on a Windows Server-based domain controller" (KB4090105), retrieved October 2026
- Microsoft Support, "How to manage PAC Validation changes related to CVE-2024-26248 and CVE-2024-29056" (KB5037754), retrieved October 2026
- Microsoft Support, "How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833" (KB5073381, November 2025), retrieved October 2026
- Microsoft Windows Server Blog, "Beyond RC4 for Windows authentication" (December 3, 2025), retrieved October 2026
- Microsoft Support, "KB5014754: Certificate-based authentication changes on Windows domain controllers", retrieved October 2026
- Microsoft Learn, "LDAP signing overview for Active Directory" (windows-server/identity/ad-ds/ldap-signing), retrieved October 2026
- Microsoft Learn, "What's new in Windows Server 2025" (windows-server/get-started/whats-new-windows-server-2025), retrieved October 2026
- Microsoft Learn, "Features removed or no longer developed in Windows Server" (windows-server/get-started/removed-deprecated-features-windows-server), retrieved October 2026
- Microsoft Support, "Latest Windows hardening guidance and key dates" (KB5036534), retrieved October 2026
- IT Partner Microsoft deadlines page: Windows Server 2016 end of extended support, January 12, 2027

## Key takeaways

- A Windows Server 2025 domain controller refuses NTLMv1, SMB1, unsigned outbound SMB, RC4-only Kerberos and weakly mapped certificates; three of the five changes cannot be switched back.
- The usual casualties: older NAS, scan-to-folder printers, Linux hosts with RC4-only keys, embedded equipment, LDAP applications bound to one domain controller, old service accounts.
- The inventory is read-only: NTLM, LDAP, SMB1, Kerberos and certificate events, DNS query logs, and a questionnaire per application owner.
- Test every category against a pilot domain controller that holds no roles, with a pass condition written first and a rollback per step.
- Never weaken a domain-wide setting for one device; isolate or replace it under a written exception with an owner and expiry date.

---

**Want the device list before the first demotion?** For one forest with up to six sites and fourteen domain controllers, [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025) runs the inventory, pilot, testing stage and cutover windows from $12,500. If nobody has audited NTLM and LDAP in your forest, start with the [Active Directory Security Assessment and Hardening](/services/active-directory-security-assessment) at $3,950 per project; our work is quoted in writing before it starts.