Windows 11 24H2+ Constant AD User Lockouts
TL;DR If Windows 11 24H2 (and 25H2) machines are randomly locking out AD accounts, and AD swears the lockout is coming from the machine while the machine swears nothing failed to log in. It’s Credential Manager quietly throwing your cached Exchange mailbox password at your domain controller. No official Microsoft fix exists as of this writing. Skip to Fixes if you just want it stopped. Symptoms Random lockouts of user AD accounts, only on Windows 11 24H2 and newer. AD shows the lockout coming from the user’s machine. The machine itself shows no failed logins, but Credential Manager logs authentication failures. The issue survives clearing Credential Manager, wiping and reinstalling Windows, and follows the user to literally any other machine they log into as long as that machine is also 24H2+. Roll a user back to Windows 10 or 23H2 and it disappears immediately. Cause Starting in 24H2, Microsoft leaned harder into cross service SSO, and Credential Manager got more aggressive about it: it now assumes your Exchange/email login, your M365 login, and your local AD login are all the same account, and starts trying cached credentials against whatever it can reach. ...