Microsoft resolves Windows 11 password rotation issue for Enterprise Devices

Microsoft has addressed an authentication issue impacting enterprise devices running Windows 11, version 24H2.

The problem, linked to the Identity Update Manager certificate with Public Key Cryptography for Initial Authentication (PKINIT), caused passwords to fail to rotate every 30 days as intended.

This issue primarily affected Kerberos Authentication devices with the Credential Guard security feature enabled. It led to authentication failures and marked devices as stale, disabled, or deleted.

While the problem was confined to enterprise environments and did not typically affect personal or home users running Windows Home Edition, it created significant challenges for businesses relying on Kerberos Authentication.

Microsoft resolved the issue in its April 2025 Windows security update (KB5055523) and subsequent patches. The update also temporarily disables the affected Credential Guard feature, which relies on password rotation, until a permanent solution is implemented.

Enterprise users are encouraged to install the latest updates to ensure their systems are secure and fully operational.