A new Lenovo ThinkPad came with Windows 11 Pro 25H2 preinstalled and works normally until it joins our domain. After the reboot, both domain and local accounts can generally launch only Microsoft Edge and File Explorer. Other applications fail with a message saying the system administrator has blocked the program.
The event logs show DistributedCOM event 10001 errors involving Microsoft.AADBrokerPlugin and the Windows Security Core background token task for the WebAccountProvider class. Resetting the laptop temporarily fixes the issue, but it returns as soon as the machine is domain-joined.
I also noticed that systeminfo reports App Control for Business as enabled, with the user-mode policy set to audit. A working Windows 11 machine does not show either setting enabled. I tried disabling Device Guard through local policy without success. Time synchronization has also been checked and is working through the domain controllers.
Another recently updated machine at a different site is now showing the same behavior after receiving Windows 11 25H2 and current updates. Has anyone identified a fix or a policy-related cause? I can install Windows 11 24H2 as a workaround, but I would prefer to understand the problem before it affects more systems.
4 Answers
Since another computer started failing after the same 25H2 update, I’d treat this as a possible 25H2 regression or an interaction with an existing domain policy. Testing a clean 25H2 installation before joining it to the domain, then adding policies gradually, should help separate the operating-system issue from the domain configuration. Installing 24H2 may be a practical temporary workaround.
The AADBrokerPlugin errors may be a symptom of the application-control policy blocking the component it needs, rather than the root cause. Compare the effective AppLocker, WDAC, and App Control policies between a working machine and the affected one, including policies coming from domain Group Policy or management tools.
Clock skew can sometimes cause domain and authentication failures, but if the machine is correctly synchronized with the domain controllers, that probably isn’t the explanation here. I’d focus on the App Control/AppLocker audit and enforcement events and identify exactly which executable or packaged application is being denied.
This sounds more like AppLocker or an App Control for Business policy than a domain-join problem by itself. Check the effective application-control policies and make sure the default packaged-app rules have been generated and applied. Missing packaged-app rules can prevent built-in and Store-based components from launching, including identity-related services.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures