I just installed Windows 10. I was part of a domain. When I try to log in I get,

"The trust relationship between this workstation and the primary domain failed."

Since I do not remember my local accounts, am I left with resetting the local administrator password with a third party tool such as the Offline Windows Password & Registry Editor and rejoining the domain or using netdom on the client.

Is there another way to make the trust relationship come back?

edit: I have tried to reset the machine account in Active Directory Users and Computers. Same error. (yes, I rebooted).

  • I changed the suggested edits, partially. I believe it is relevant to put the Pogostick link so it is clear what I mean by resetting. That I need a third party tool such as that. – johnny Jul 30 '15 at 17:58
  • possible duplicate of Re-joining a computer to domain – Ƭᴇcʜιᴇ007 Jul 30 '15 at 18:11
  • AFAIK (and as the answers in the marked possible dupe seem to also concur) the only way to rebuild that trust it to dis-join the computer from the domain, delete it's AD account, and then re-join. – Ƭᴇcʜιᴇ007 Jul 30 '15 at 18:14
  • You might look into Reset-ComputerMachinePassword – Ben N Dec 28 '15 at 22:55
up vote 9 down vote accepted

You can fix this without removing/rejoining the domain if:

A) You have a local admin account on the machine that you know the password for, or

B) You have logged in to the machine with a domain account with admin credentials in the past.

If A, just log in with the local admin credentials and then proceed to the next part. If B, disconnect the network cord, disable wireless, etc, and then log in as your local admin domain account.

Open PowerShell and run the following commands:

$credential = Get-Credential

Enter a domain admin account.

Reset-ComputerMachinePassword -Server DomainControllerName

This command will reset the machine password with the domain controller and you should be able to resume normal domain network access now.

I found this solution here and found it has worked multiple times: https://community.spiceworks.com/how_to/108912-fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed

  • And maybe you know how you would do this remotely using a domain admin account, for the case of if you don't have access to the local admin account, and the server is a VM, so you can't unplug the network cable? – vapcguy Aug 3 '17 at 18:45
  • Being a VM shouldn't make a difference. Both HyperV and ESXi are capable of virtually disconnecting network cables. Remote access generally assumes some domain communication in most cases and so may not work, though if you have access to the hypervisor you'll have console access which is the same as physical access when dealing with VMs. However, as clearly stated in my answer, you do need an admin account which is recognized by the faulty computer. The two cases (knowing a local admin account, knowing a domain account with admin rights) are both dealt with in my answer. – music2myear Aug 3 '17 at 18:54
  • Fortunately I found this... superuser.com/questions/555297/… – vapcguy Aug 4 '17 at 22:55

I can't comment on the solution provided by music2myear, however there seems to be another step to the process. In the comments below the article linked in music2myear's answer, a more complete answer is provided.

Open PowerShell and run the following commands:

$credential = Get-Credential

Enter a domain admin account.

Reset-ComputerMachinePassword -Server DomainControllerName -Credential $credential

I was not able to get my issue resolved until providing the credential as the last parameter.

As another note, I assumed my domain controller to be, well, the domain name (i.e. MyDomain.local), however for the DomainControllerName, I had to provide the Computer/Host Name of the domain controller.

  • Thanks for the clarification. I don't know if a different powershell version might automatically use the $credential argument stored previously, but your method is more explicit and should work in more cases. – music2myear Sep 29 '16 at 15:42
  • The Domain Controller (DC) is not the same as the Domain Name (DN). The DC is the computer (or one of the computers) with the DC role in a Windows network with a domain. The DN is the name give to that domain when you set it up. – music2myear Sep 29 '16 at 15:48
  • 1
    @music2myear Careful using the acronym "DN". The real "DN", as it relates to AD, actually means distinguishedName and that looks like CN=servername,DC=domain,DC=com. Totally different. But your comment is correct. – vapcguy Aug 3 '17 at 18:48

I had a similar issue after upgrading a machine to Windows 10, although I knew the local admin password! In my case, I thought that renaming the computer to get a new AD account for it would solve it, (as this is often sufficient when a VM drops out due to reverting a snapshot) but it did not work for this case.

The solution was a full removal of the computer from the domain, reboot, join back in, and reboot again.

protected by Community Jun 26 '17 at 7:31

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.