Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Mission

I have one AD account that I, at different times, want to use at two phyiscal computers (referred to as computer1 & computer2). To be clear about the time aspeact, I never want to be logged in on both computers at a certain time.

Info

  • In Computer1 Windows is installed and joined to the domain. I have permission to do this myself
  • Software: Windows7 x64 SP1
  • One constraint to my solution is that I will have to use the same computer name.

Problem description

Now to the problem. On computer2 I install Windows and added computer2 to the domain as well. It worked well, but then when I logged out and tried to log in on computer1 I got a error message:

This computer is unable to establish a trust relationship with the server

Temporary Solution

The issue was quickly solved by removing computer1 from the domain and re-joining it again using my local admin account. However, I don´t want to do that each time I switch computer.

Thoughts and Questions

From what I´ve read on the internet one way to solve the issue might be to unplug the network adapter and login to disable Windows from checking with the AD server, and then re-connect the network cable again. Haven´t verified this solution.

I´ve also read about SIDs in various forms. One is something called "computer SID" or "machine SID" which seems to be string that is used to represent/identify the actual computer associated with an AD account. Just a theory, but if I can synchronize those SIDs between the two computers then would I be able to use them as I plan?

Are there any risk involved with using one AD account at two different computers? I don´t use the file share pushed out by the admins. But perhaps there are other things that I use in the background that may cause trouble?

I´m using Windows7, and I guess the functionality to remotely administrate my computer is built into the OS by now (compared to WinXP). What kind of reports are the admins able to get from me? Can they for example get a list of all the applications I´ve installed?

Even though it isn´t needed, I stil wonder what will happens if I log in on both computers at the same time?

And the final question, is it possible to solve my problem?

share|improve this question
    
The machine SID is only used for local accounts, and should be different between computers. Domain logins always use the domain SID for identification. –  grawity Mar 14 '12 at 21:34
    
You do not mention Computer2 was ever on domain.... –  ZaB Mar 14 '12 at 22:00
    
Computer2 have never been in the domain historically, but I want to add it to the domain. The background is that I work from two geographically different locations and don´t want to carry my laptop all the time. That´s why I want to configure two computers, and have them permanently at two different locations, but use the same AD-creds. when I use them. Please let me know if my problem description still is unclear. –  user99447 Mar 15 '12 at 9:23
    
Is this correct, comptuer1 joined to domain with name X, computer2 joined to domain afterwards with name X also?? If I understand that correct, what causes the need to have the same name because that is the root of your issue. –  edusysadmin Apr 24 '12 at 14:29

1 Answer 1

I was able to login using cached credentials, however I was still denied some resources.

I think this issue is tied to the computer name. Here is a citation from the Event Log

This computer could not authenticate with \my.ds.net, a Windows domain controller for domain XYZ, and therefore this computer might deny logon requests. This inability to authenticate might be caused by another computer on the same network using the same name or the password for this computer account is not recognized. If this message appears again, contact your system administrator. SOURCE: NETLOGON

How does the authorization model work in AD? Can I come up with a new computer name all by my self, or is it tied to my domain account?

share|improve this answer
    
update, the denial of resouces was not related to the cited error message. I think the message is what you get if you use cached creditials. Anyhow, my trailing question is still interesting. –  user99447 Mar 21 '12 at 13:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.