Description of problem:
In a Fedora 42 machine joined to AD DS by sssd and realmd (Windows Server 2022 DCs with Server 2016 Functional Level), sssd fails to rotate the machine account password, as dictated by:
ad_maximum_machine_account_password_age = 30 days (default configuration)
ad_machine_account_password_renewal_opts = 86400:750:300:realm (default configuration)

Version-Release number of selected component (if applicable):
sssd-ad.x86_64                          2.11.0-1.fc42
realmd.x86_64                           0.17.1-15.fc42

How reproducible:
Always

Steps to Reproduce:
1. Install a Fedora 42 host, patch it and join to AD DS domain
2. Wait for the default 30 days of time to pass, or modify ad_maximum_machine_account_password_age to shorter value
3. Monitor PasswordLastSet/msDS-KeyVersionNumber attributes in AD DS, they never change

Actual results:
The password is never rotated.

Expected results:
The password is rotated.

Additional info:
In sssd_domain_name.log you can see sssd trying to rotate the password by calling realm command and failing. Here is a snippet of my log:

   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [ad_machine_account_password_renewal_done] (0x1000): --- adcli output start---
 realm discover -v [realm-name]
   Discover available realm

 realm join -v [-U user] realm-name
   Enroll this machine in a realm

 realm leave -v [-U user] [realm-name]
   Unenroll this machine from a realm

 realm list
   List known realms

 realm permit [-ax] [-R realm] user ...
   Permit user logins

 realm deny --all [-R realm]
   Deny user logins
---adcli output end---
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_done] (0x0400): Task [AD machine account password renewal]: finished successfully
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [be_ptask_schedule] (0x0400): Task [AD machine account password renewal]: scheduling task 60 seconds from last execution time [1752134253]
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x1000): Waiting for child [86188].
   *  (2025-07-10  9:56:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86188] failed with status [2].
********************** BACKTRACE DUMP ENDS HERE *********************************

(2025-07-10  9:57:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86192] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:58:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86205] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10  9:59:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86211] failed with status [2].
   *  ... skipping repetitive backtrace ...
(2025-07-10 10:00:33): [be[corp.cavanasystems.com]] [child_sig_handler] (0x0020): child [86218] failed with status [2].
   *  ... skipping repetitive backtrace ...

You can see it is calling the realm command to do the rotation but the latter is returning like it is being called with the wrong parameters.
It is then retrying every minute because I've altered my configuration as such, for debugging purposes:
ad_maximum_machine_account_password_age = 30
ad_machine_account_password_renewal_opts = 60:5