Merge pull request #9372 from MicrosoftDocs/main

Auto push to live 2025-07-18 02:40:39

Author: Simonx Xu

support/windows-server/active-directory/accounts-lastlogontimestamp-future-time.md

@@ -1,7 +1,7 @@
 ---
 title: Accounts Have the LastLogonTimestamp Value Set to Future
 description: Helps resolve an issue in which user or computer accounts have the lastLogonTimestamp value set to a future time.
-ms.date: 03/11/2025
+ms.date: 07/18/2025
 manager: dcscontentpm
 audience: itpro
 ms.topic: troubleshooting
@@ -34,7 +34,7 @@ For previous versions of Windows, the approaches to resolve the issue are to:
 - Ignore the `lastLogonTimestamp` value and use other metrics to identify orphaned accounts.
 - Delete the affected accounts and create new ones.
 
-In Windows Server 2025, there's a new facility to repair broken objects as specified in [[MS-ADTS]: fixupObjectState](/openspecs/windows_protocols/ms-adts/37294765-9e7d-41a1-aded-2d6f744eee8c).
+In Windows Server 2022 and Windows Server 2025, there's a new facility to repair broken objects as specified in [[MS-ADTS]: fixupObjectState](/openspecs/windows_protocols/ms-adts/37294765-9e7d-41a1-aded-2d6f744eee8c).
 
 > [!NOTE]
 > There's functionality to correct missing `sAMAccountType` and `objectCategory` attributes. For more information, see [Can't edit or delete an AD object and receive the error "attribute is owned by the Security Accounts Manager (SAM)" or "The specified account does not exist"](cannot-edit-delete-ad-object-error-sam.md).

support/windows-server/active-directory/cannot-edit-delete-ad-object-error-sam.md

@@ -1,7 +1,7 @@
 ---
 title: Can't Edit or Delete an AD Object and Receive Errors
 description: Helps resolve an issue where you can't edit or delete an AD object and receive the error Attribute is owned by SAM or The specified account does not exist.
-ms.date: 03/11/2025
+ms.date: 07/18/2025
 manager: dcscontentpm
 audience: itpro
 ms.topic: troubleshooting
@@ -99,7 +99,7 @@ The object was deleted and undeleted. Deleted objects don't have the `sAMAccount
 >
 > If the undeletion was done recently, you can restore the object using a backup in an authoritative restore. This also restores these attributes.
 
-To resolve this issue,  use the new facility included in Windows Server 2025 to repair broken objects as specified in [[MS-ADTS]: fixupObjectState](/openspecs/windows_protocols/ms-adts/37294765-9e7d-41a1-aded-2d6f744eee8c).
+To resolve this issue, use the new facility included in Windows Server 2022 and Windows Server 2025 to repair broken objects as specified in [[MS-ADTS]: fixupObjectState](/openspecs/windows_protocols/ms-adts/37294765-9e7d-41a1-aded-2d6f744eee8c).
 
 > [!NOTE]
 > There's also functionality to repair the `LastLogonTimeStamp` attribute. For more information, see [User or computer accounts have the lastLogonTimestamp value set to a future time](accounts-lastlogontimestamp-future-time.md).

support/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys.md

@@ -1,7 +1,7 @@
 ---
 title: Registry entries about Kerberos protocol and Key Distribution Center (KDC)
 description: Lists the registry entries in Windows Server that can be used for Kerberos protocol testing and troubleshooting Kerberos authentication issues.
-ms.date: 01/15/2025
+ms.date: 07/18/2025
 manager: dcscontentpm
 audience: itpro
 ms.topic: troubleshooting
@@ -231,7 +231,7 @@ The registry entries that are listed in this section must be added to the follow
   - Default value: 0
   - Possible values: 0 (false) or any non-zero value (true)
 
-    This value indicates whether IP addresses will be added in the Ticket-Granting Service Reply (TGS_REP).
+    This value indicates whether IP addresses will be added in the Ticket-Granting Service Reply (TGS_REP). If the resource server enforces validation of this optional field and detects a mismatch between the client's IP address and the ticket's value, the error KRB_AP_ERR_BADADDR ("Incorrect net address") is returned, and the logon fails.
 
 - Entry: KdcDontCheckAddresses