Hello baehrm ,
Thank you for the report, and sorry to hear the issue is still occurring for you. For context: the original NTLM-fallback problem was fixed in 2025.3.12.0 (and carried into the first 2026.1 iteration), so a recurrence on 2026.2.7.0 points to a different underlying cause in your environment rather than the original bug. We do have another internal ticket opened to handle this new situation. To understand what's happening on your end, could you share the following?
The error itself:
1- The exact error message and LDAP result code you see on the failing heartbeat — is it still an LDAP Code 49, or something different? The precise wording matters here.
2- You mentioned credential checkout works, but the "out of sync" message won't clear — does the heartbeat itself report success at any point, or does it fail every time? A screenshot of the entry's status/heartbeat detail would help.
From the domain controller — this is the most important part. At the exact timestamp of a failed heartbeat, please pull the Security event log and let us know:
3- Do you see NTLM events (4776, with error 0xC000006E, and any 4822 Protected Users block) at that time?
4-Do you see any Kerberos events (4768 / 4769) at that same timestamp, or none at all? If there are no Kerberos events, authentication never attempts Kerberos and goes straight to NTLM.
On the environment/configuration:
5- Is the DVLS host domain-joined, and does the DC your provider targets have a registered ldap/<fqdn> SPN? The output of setspn -Q ldap/<your-dc-fqdn> would confirm this.
6- In the provider settings, are you connecting to the DC by its real FQDN, or through an alias / load-balanced name (which may not have its own SPN)?
7- What does your AD topology look like — specifically, is the Kerberos realm the same as the domain name, or is the domain you're using actually a UPN suffix alias of a different real realm?
A quick comparison test:
8- Does the User Validity diagnostic succeed for the same account (in both DOMAIN\user NetBIOS and UPN form) that fails in the heartbeat? If the diagnostic passes but the heartbeat fails, the two paths are diverging, and that's a strong clue.
I encourage you not to share log details publicly. You can send them to service@devolutions.net with a reference to this thread — we can dig into the anonymized DC logs there.
Thank you for your collaboration.
