16

I just installed Windows 10. I was part of a domain. When I try to log in I get,

"The trust relationship between this workstation and the primary domain failed."

Since I do not remember my local accounts, am I left with resetting the local administrator password with a third party tool such as the Offline Windows Password & Registry Editor and rejoining the domain or using netdom on the client.

Is there another way to make the trust relationship come back?

edit: I have tried to reset the machine account in Active Directory Users and Computers. Same error. (yes, I rebooted).

5
  • I changed the suggested edits, partially. I believe it is relevant to put the Pogostick link so it is clear what I mean by resetting. That I need a third party tool such as that.
    – johnny
    Jul 30, 2015 at 17:58
  • possible duplicate of Re-joining a computer to domain Jul 30, 2015 at 18:11
  • AFAIK (and as the answers in the marked possible dupe seem to also concur) the only way to rebuild that trust it to dis-join the computer from the domain, delete it's AD account, and then re-join. Jul 30, 2015 at 18:14
  • 1
    You might look into Reset-ComputerMachinePassword
    – Ben N
    Dec 28, 2015 at 22:55
  • 1
    The answers all show how to fix the broken trust/domain-relationship, however I'm curious if anyone wants to answer WHY THIS HAPPENS as asked by @johnny in the title?
    – gregg
    Jul 11, 2019 at 19:12

5 Answers 5

18

You can fix this without removing/rejoining the domain if:

A) You have a local admin account on the machine that you know the password for, or

B) You have logged in to the machine with a domain account with admin credentials in the past.

If A, just log in with the local admin credentials and then proceed to the next part. If B, disconnect the network cord, disable wireless, etc, and then log in as your local admin domain account.

Open PowerShell and run the following commands:

$credential = Get-Credential

Enter a domain admin account.

Reset-ComputerMachinePassword -Server DomainControllerName

This command will reset the machine password with the domain controller and you should be able to resume normal domain network access now.

I found this solution here and found it has worked multiple times: https://community.spiceworks.com/how_to/108912-fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed

4
  • And maybe you know how you would do this remotely using a domain admin account, for the case of if you don't have access to the local admin account, and the server is a VM, so you can't unplug the network cable?
    – vapcguy
    Aug 3, 2017 at 18:45
  • 2
    Being a VM shouldn't make a difference. Both HyperV and ESXi are capable of virtually disconnecting network cables. Remote access generally assumes some domain communication in most cases and so may not work, though if you have access to the hypervisor you'll have console access which is the same as physical access when dealing with VMs. However, as clearly stated in my answer, you do need an admin account which is recognized by the faulty computer. The two cases (knowing a local admin account, knowing a domain account with admin rights) are both dealt with in my answer. Aug 3, 2017 at 18:54
  • Fortunately I found this... superuser.com/questions/555297/…
    – vapcguy
    Aug 4, 2017 at 22:55
  • 2
    Running those two commands as detailed above failed for me. Combining them fixed the trust relationship! Reset-ComputerMachinePassword -Server DomainControllerHostName -Credential [email protected]
    – gregg
    Jul 11, 2019 at 19:06
18

I can't comment on the solution provided by music2myear, however there seems to be another step to the process. In the comments below the article linked in music2myear's answer, a more complete answer is provided.

Open PowerShell and run the following commands:

$credential = Get-Credential

Enter a domain admin account.

Reset-ComputerMachinePassword -Server DomainControllerName -Credential $credential

I was not able to get my issue resolved until providing the credential as the last parameter.

As another note, I assumed my domain controller to be, well, the domain name (i.e. MyDomain.local), however for the DomainControllerName, I had to provide the Computer/Host Name of the domain controller.

3
  • Thanks for the clarification. I don't know if a different powershell version might automatically use the $credential argument stored previously, but your method is more explicit and should work in more cases. Sep 29, 2016 at 15:42
  • The Domain Controller (DC) is not the same as the Domain Name (DN). The DC is the computer (or one of the computers) with the DC role in a Windows network with a domain. The DN is the name give to that domain when you set it up. Sep 29, 2016 at 15:48
  • 1
    @music2myear Careful using the acronym "DN". The real "DN", as it relates to AD, actually means distinguishedName and that looks like CN=servername,DC=domain,DC=com. Totally different. But your comment is correct.
    – vapcguy
    Aug 3, 2017 at 18:48
1

I had a similar issue after upgrading a machine to Windows 10, although I knew the local admin password! In my case, I thought that renaming the computer to get a new AD account for it would solve it, (as this is often sufficient when a VM drops out due to reverting a snapshot) but it did not work for this case.

The solution was a full removal of the computer from the domain, reboot, join back in, and reboot again.

0

In my case I had to connect to company VPN and than I was able to run command without that error.

I was trying to add back Microsoft Store app with:

Get-AppxPackage -allusers Microsoft.WindowsStore | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
0

For my situation, including -Server MyDomainControllerName did not work. (Probably because it was pointing to a now invalid Domain Controller.) Instead, I just removed that argument, and it was able to automatically find a valid Domain Controller.

Step by Step:

  1. Disable network (disconnect ethernet, disable wifi, disable VM network, etc)

  2. Login with (old) password

  3. Enable network

  4. Start PowerShell as Administrator

  5. Reset-ComputerMachinePassword -Credential ""

    This will prompt for your credentials. Enter your DOMAIN\USERNAME, and current PASSWORD.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .