Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a problem with a Windows 7 PC that had been a member of the domain. When I try to logon to this PC with domain credentials I get a message similar to

The trust relationship between this workstation and the primary domain could not be established.

Now I need to reestablish the membership of the PC in the domain. But since I can't logon I can't change neither the computer name nor the domain membership.

  • How can I re-trust PC and domain?
  • Can I add or renew the membership from the domain controllers console?

Edit:

There are no active local accounts on the machine that I could use to logon.

share|improve this question
    
Do you have access to AD UC? –  Tanner Feb 21 '13 at 15:23
    
Access to what? I assume: AD=active directory UC=?? But: Yes, I have administrative rights to the domain. –  harper Feb 21 '13 at 15:33
add comment

3 Answers 3

Stop fighting with this problem from the client side. If you can't log in to the domain, you're either going to have to log in with an enabled local account, or use a boot CD to enable one.

Try removing the machine from Active Directory Users and Computers. It should be in the Administrative Tools on your server. Open the OU (organizational unit) that contains the computer. Find the computer, right click on it, and hit delete.

enter image description here

It might not hurt to be patient and just let replication do its thing, depending on how many DCs you have. If your domain is pretty simple (no sites and just two DCs) you could use repadmin /replicate to force replication. Give this a read before doing so.

Now add the PC again using AD UC and either wait for replication or force it.

If it still whines at you, give netdom /remove a try (man page here) and see if that will get it off your domain. If you have trouble with that, take a look at this question. It's a different scenario but essentially the same concept: trying to remove a computer from a domain when it can't contact the DC.

share|improve this answer
1  
This will delete the PC from the domain, won't it? How do I use the domain authentication to logon at the PC when it is not a domain member anymore? Can't I add it with ADUC? –  harper Feb 21 '13 at 17:00
    
You're right. Hadn't had my coffee yet... –  Tanner Feb 21 '13 at 17:08
add comment

You may have to log in using credentials that are local to that machine. When the OS was first installed, there is a local account that is set up.

Log in with that account using the Computer Name as the domain (ex. MYCOMP\JSmith). Usually the local machine administrator account is present but disabled by default.

Once you are logged in as a local user, you should be able to leave and rejoin the domain.

share|improve this answer
    
Leaving and re-entering the domain is the preferred fix to this. However, sometimes it just doesn't work and you'll also need to change your computer name if Active Directory doesn't understand the change for whatever reason. –  Lee Harrison Feb 21 '13 at 14:28
add comment
up vote 0 down vote accepted

It's only possible to add the PC when you have the administrators rights at the PC and the right to change the DC.

Therefore it is necessary to reset the administrators password at the PC. One way to perform this task is the use of the installation DVD and use the repair console. This allows you to regain the full control.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.