• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Windows 11 23H2 to 25H2 Upgrade Allegedly Breaking Internet Connectivity

MrGuvernment

MrGuvernment

Fully [H]
2FA
Joined
Aug 3, 2004
Messages
23,944
Not surprising..........

Windows 11 23H2 to 25H2 Upgrade Allegedly Breaking Internet Connectivity​

https://cybersecuritynews.com/windows-11-23h2-to-25h2-upgrade/


A persistent bug in Windows 11 in-place upgrades is reportedly wiping critical 802.1X wired authentication configurations, leaving enterprise workstations completely offline until manual intervention is performed.

System administrators across Reddit’s r/sysadmin community are raising alarms as the issue originally observed during Windows 10-to-11 migrations has now reappeared across annual Windows 11 version upgrades, including the 23H2-to-24H2 and 23H2-to-25H2 upgrade paths.

What Is Happening

During an in-place Windows 11 upgrade, the contents of the C:\Windows\dot3svc\Policies folder that stores 802.1X wired network (LAN) authentication profiles applied via Group Policy are silently deleted.

The dot3svc service (Wired AutoConfig) relies on these policy files to authenticate machines against network switches enforcing IEEE 802.1X port-based access control.

Once the folder is wiped, the upgraded machine loses all wired network connectivity the moment it boots into the new OS version, effectively cutting it off from the corporate network.

The catch-22 nature of the bug makes it particularly damaging in enterprise environments: without network access, the machine cannot receive a fresh Group Policy push to restore its 802.1X configuration.

Administrators must physically connect the affected device to a non-802.1X-enforced switch port or network segment, manually run gpupdate /force, and then reconnect it to the secured port. Only then does the wired authentication configuration get rewritten to the dot3svc\Policies folder.

The problem is not new. Documented cases on Microsoft Q&A stretch back to Windows 10 22H2 → Windows 11 23H2 migrations, with multiple reports confirming 802.1X authentication failures immediately after upgrade completion.

However, sysadmins confirm that the same data-loss behavior is now repeating across annual Windows 11 version upgrades, meaning the issue has persisted through at least three major release transitions without an official fix from Microsoft.

In some upgrade scenarios, the problem extends beyond dot3svc policy files; in-place upgrades have also been reported to delete the machine’s computer certificate store, further compounding authentication failures for organizations relying on EAP-TLS with PKI certificates.

Available Workarounds

Sysadmins have documented several interim mitigations while awaiting an official fix:
  • Backup and restore: Copy C:\Windows\dot3svc\Policies to external storage before upgrading and restoring it immediately after the new OS boots.
  • Post-upgrade gpupdate: Connect the device to a non-dot1x port and run gpupdate /force /target:computer to force policy re-application.
  • SetupCompleteTemplate.cmd: Inject LAN profile restoration commands into the Windows setup completion script.
  • MECM task sequence step: For managed deployments, add a post-upgrade step to re-push 802.1X settings before the device rejoins the secured network.

Microsoft has not publicly acknowledged this regression as a known issue on its Windows 11 release health dashboard, and no dedicated KB article or hotfix has been issued as of this writing.

Administrators managing large fleets should audit their upgrade workflows and implement dot3svc policy backup steps before deploying Windows 11 24H2 or 25H2 at scale.
Click to expand...
 
Yeah, Microsoft is getting better but it'll always be sloppy with certain things. I run IT for my Org and I allow "stepping" in the GPOs and Intune/Entra policies. When I authorized 24H2 I capped it there. No machine can upgrade past 24H2. I'm running 25H2 on a laptop as a fresh build. Most machines have either upgraded by now from 23 to 24. Probably sometime next year I'll authorize 25H2 if nothing dumb happens.
 
OFaceSIG said:
Yeah, Microsoft is getting better but it'll always be sloppy with certain things. I run IT for my Org and I allow "stepping" in the GPOs and Intune/Entra policies. When I authorized 24H2 I capped it there. No machine can upgrade past 24H2. I'm running 25H2 on a laptop as a fresh build. Most machines have either upgraded by now from 23 to 24. Probably sometime next year I'll authorize 25H2 if nothing dumb happens.
Click to expand...
Same, when I heard about some initial 25H2 issues i had it blocked in our tenant, similar when 24H2 initially dropped. No harm staying one main release back for a little while until the big bugs are worked out.
 
MrGuvernment said:
Same, when I heard about some initial 25H2 issues i had it blocked in our tenant, similar when 24H2 initially dropped. No harm staying one main release back for a little while until the big bugs are worked out.
Click to expand...

Yup.

While I am not generally a supporter of holding back security patches, when you are dealing with two main releases both of which are supported, there is rarely any benefit to jumping right on the new one. Let someone else be the beta tester.
 
It feels like Microsoft has turned to vibe coding Windows because something is always breaking with updates. It's become a biweekly or monthly event with Windows.
 
Who the hell is creating these upgrades? Mr. Magoo. If your developers are good enough you might get a way with pulling back on QA, but both? Like the code breaks stuff AND QA doesn't catch it? What are they doing?
 
On the bright side... once this update breaks internet connectivity, system will be unable to download future updates from the internet that could break other things. The last update you'll ever need! :p
 
giphy.gif
 
Lakados said:
Yeah, hilarious, but it still screwed up a handful of my Dell Laptops purchased in 2024... Because, for whatever reason, Dell decided to configure the BIOS on them to use Rapid Storage instead of ACHI for the boot drives.
Click to expand...
This seems to be the default, any devices I get my hands on for work, i learned to go into the bios and make sure it was on AHCI, and not Raid, then nuke and redo.
 
MrGuvernment said:
This seems to be the default, any devices I get my hands on for work, i learned to go into the bios and make sure it was on AHCI, and not Raid, then nuke and redo.
Click to expand...
Ah yeah I ran into this recently as well. Was a bit paranoid I was going to break something (overwrite boot drive somehow was my fear) so it was the last thing I tried, but it fixed it.
 
Quite a few OEMs of desktops and laptops over the years produced certain models of desktops and laptops where for whatever reason they thought using the RAID mode by default was a good idea. I always did the same thing, set them back to AHCI and reinstall. Leaving them in RAID was always a matter of when it caused data loss, not if.

The only worse thing the OEMs ever did was the Optane cache drives. Almost all of those Optane drives failed within the PCs early to mid lifespan causing loss of the OS and more often than not loss of the data on the main drive as well.

More complexity on storage that needs to be reliable first and foremost is never a good idea.
 
Advil said:
Quite a few OEMs of desktops and laptops over the years produced certain models of desktops and laptops where for whatever reason they thought using the RAID mode by default was a good idea. I always did the same thing, set them back to AHCI and reinstall. Leaving them in RAID was always a matter of when it caused data loss, not if.

The only worse thing the OEMs ever did was the Optane cache drives. Almost all of those Optane drives failed within the PCs early to mid lifespan causing loss of the OS and more often than not loss of the data on the main drive as well.

More complexity on storage that needs to be reliable first and foremost is never a good idea.
Click to expand...
You couldn't catch me EVER setting RAID over AHCI. Why? Because RAID on MBs has different software versions. I learned my lesson when we got a whole bunch of computers with nForce MB's and RAID as the OEM default (yes I'm that old). Nope.
 
Advil said:
Quite a few OEMs of desktops and laptops over the years produced certain models of desktops and laptops where for whatever reason they thought using the RAID mode by default was a good idea. I always did the same thing, set them back to AHCI and reinstall. Leaving them in RAID was always a matter of when it caused data loss, not if.
Click to expand...
Seems to be standard for Dell for quite some time (we buy a lot of them at work). My 2024 ASUS laptop was the same. I've tried to find out why the fuck they do that for a single disk and as best I can tell it is because calling it "RAID mode" isn't correct anymore it is "Intel VMD mode". In theory, I think it should allow for more management features and better performance. In practice... not sure it makes any difference on a desktop system. I did some performance testing (which required reinstalling) in different modes on a system and I didn't notice any difference.

We haven't had any data loss that I'm aware of. We used to change them to AHCI but it became easier to just update the gold image to include the drivers.
 
Yes but the VMD mode thing is only a very recent excuse. A whole hell of a lot of laptops and desktops were set to RAID mode over the years before VMD ever existed. OEM shenanigans and a desire to turn on features to make the spec sheet look impressive.
 
I've never understood it, and the VMD thing actually seems to make no difference I can find in actual usage other than that you can't update your SSD firmware in VMD mode.

Seems common with manufacturers though.
 
MrGuvernment said:
This seems to be the default, any devices I get my hands on for work, i learned to go into the bios and make sure it was on AHCI, and not Raid, then nuke and redo.
Click to expand...
Yeah, but as part of my config with Dell that they load in is supposed to have it already on AHCI, I mean, they are getting my BIOS admin passwords in place, and the other things, and many other units had AHCI set correctly just that batch.... So I'm gonna have to recall the lot of those ones over the summer and rebuild them.... yay.

Probably take that time to replace their batteries while I'm at it.
 
You must log in or register to reply here.
Back
Top