How do youre establish a trust relationship between workstation and domain?
|
I am getting this error message on a couple Windows 10 machines: "The trust relationship between this workstation and the primary domain failed" It is when you try to log in. However, I can get past this error by disconnecting the internet/Wi-Fi, then login, then reconnect the internet/Wi-Fi. If I keep the internet connected while trying to log in, I get that error message. I tried changing the IP address to static to DHCP. I tried
adding a user as an administrator. I tried to find the computer in Active Directory and resetting the account. Any ideas on how to fix this? I would like to avoid leaving and rejoining the domain, because I did that before and some data was lost. Any other fixes maybe? I tried numerous reboots and different logons. Any help is greatly appreciated. These are both Windows 10 desktops. We have 2 ADs, both on Windows Server 2012 R2. If, at logon, you receive an error message that the trust relationship between a workstation and the primary domain failed, and you cannot logon, there are several ways to deal with the issue. These solutions also work on Windows 11 systems, where you may still log on, but the network connections tray icon in the system claims that the computer is part of an unidentified network.
Welf has been working as a system administrator since the year 2000. He focuses on IT security for the Windows platform. Contents
Why the trust relationship failed ^Technically, a domain trust relationship is established when a machine joins the domain and is maintained automatically from then on. When the machine joins the domain, a machine password is created that the domain controllers use to authenticate the machine. This password automatically changes every 30 days. One reason why the trust relationship might fail is that your domain controllers have replication problems and are no longer in sync. For instance, while only the new password is valid on DC1, the old password is still active on DC2. As soon as your client contacts DC2 for logon, it will throw that error. Since you cannot proactively prevent replication problems, this will not be addressed in this article. The second more common reason for this error surfaces when you restore a domain-joined Windows from an image backup, and the backup was created before the last password change. As said, the password changes every 30 days; thus, if you create a backup on day 29, the password will already be expired if you restore the next day. If you then try to log on with a domain account, you will receive this error message:  The trust relationship between this workstation and the primary domain failed The error message may vary depending on your Windows version. In Windows 11, you may even be able to log on, but then the network tray icon will display unidentified network. You may still be able to access domain resources, but since the firewall profile is not the domain profile, you'll definitely run into various issues. Avoiding the trust relationship problem ^To avoid the workstation losing trust with the Windows domain, you can use the command line tool nltest.exe right before imaging. It can change the machine password so you know for sure that this image can be restored at least 30 days after its creation: Initiating a password change right before the backup We cannot change the fact that system passwords in system images expire, but we can at least make sure that the restore works without issues within the 30-day period. Restoring the trust relationship ^When it comes to restoring the trust relationship, a simple trick is to disconnect the network cable immediately after the backup has been restored. Simply log on with any administrator account using cached credentials. To re-establish the trust relationship, enter this command on an elevated PowerShell: reset-computermachinepassword –credential yourdom\resetaccountResetting the machine password This method will only work if an admin has previously logged on and their credentials are in the cache. The domain account "resetaccount" will not need to be admin on the machine in question, nor be domain admin. However, it needs to hold the privilege to reset machine account passwords on the computer OU (or on that single computer object respectively). If, however, no admin credentials are in the cache, you can use only a local administrator account. Perhaps you didn't create a local admin account and the built-in administrator account is disabled—what now? The solution is to boot to the command prompt in WinRE and activate the local administrator account. To make this easier, you can save the following lines to activate.bat on a USB drive: reg load HKLM\TEMP c:\windows\system32\config\sam for /f "tokens=3" %%a in ('reg query HKLM\TEMP\SAM\Domains\Account\Users\000001F4 /v F') do set str=%%a set str=%str:2000011=2000010% reg add HKLM\TEMP\SAM\Domains\Account\Users\000001F4 /v F /t REG_BINARY /d %str% /f reg unload HKLM\TEMPThis script activates the local administrator account. If you know its password, you are good to go now, but if you don’t, you need to follow this procedure: At the command prompt, run this command: Open regedit and navigate to this location: HKLM\TEMP\SAM\Domains\Account\Users\000001F4 Double-click the V-value, navigate to the position in the next screenshot, and replace the following positions marked in yellow with 00. Before the change What have we just done? These two values tell the system how long the LM/NTLM password hash of the built-in administrator account is, and we zeroed them, so the system thinks the password is empty. After the change Finally, at the command prompt, use: reg unload HKLM\TEMPThen restart, and you can now log on as built-in administrator without a password and reset the machine password. Afterwards, disable the built-in administrator again. How do you're establish a trust relationship between workstation and domain?Here is the classical way to repair trust relationship between the computer and domain:. Reset the computer account in AD;. Move the computer from the domain to a workgroup under the local administrator;. Reboot;. Rejoin the computer to the domain;. Restart the computer again.. How do you establish trust between domains?Open the Active Directory Domains and Trusts administrative tool. In the console tree, right-click your domain, and then click Properties. On the Trusts tab, click New Trust, and then click Next. On the Trust Name page, type the DNS name of the domain to which you want to create a trust, and then click Next.
What does it mean the trust relationship between this workstation?The “trust relationship between this workstation and the primary domain failed” error means that the computer cannot access a network because it is offline, or that it has lost its membership to the Active Directory (AD) domain.
What is the meaning of the trust relationship between this workstation and the primary domain failed?This error occurs because of a “password mismatch.” In Active Directory environments, each computer account also has an internal password – if the copy of the computer account password that is stored within the member server gets out of sync with the password copy that is stored on the domain controller then the trust ...
|
