Balaji Ramamoorthy
Download CV

The trust relationship between this workstation and the primary domain failed

Real issue · 2 min read

Why a domain-joined machine loses its secure channel, and how to repair it with PowerShell without leaving and rejoining the domain.

Share on LinkedIn

Symptom

A domain-joined Windows server or PC rejects domain logons. The message is one of these:

  • "The trust relationship between this workstation and the primary domain failed."
  • "The security database on the server does not have a computer account for this workstation trust relationship."

Local administrator logons still work.

Where it happened

Virtual machines restored from a snapshot or backup, machines that were off the network for a long time, and machines whose computer account was reset or removed in Active Directory.

What I checked

  • Whether the computer account still exists in Active Directory, and is not disabled.
  • Whether the clock is within five minutes of a domain controller. Kerberos fails when the time is out.
  • Whether the machine can find and reach a domain controller through DNS.
  • Whether the machine was recently reverted to a snapshot.
Test-ComputerSecureChannel -Verbose
nltest /sc_verify:contoso.com
w32tm /query /status

Root cause

A domain-joined computer has a password for its own account, and it changes that password about every 30 days. If the machine goes back to an older state, such as a snapshot, its stored password no longer matches the one Active Directory holds. The secure channel between the machine and the domain breaks.

The fix

Sign in with a local administrator account, then repair the secure channel. This keeps the computer name, the account and the security identifier, so permissions and group memberships are kept.

Test-ComputerSecureChannel -Repair -Credential (Get-Credential CONTOSO\admin-account)

If that fails, reset the machine password against a specific domain controller, then restart:

Reset-ComputerMachinePassword -Server DC01.contoso.com -Credential (Get-Credential CONTOSO\admin-account)
Restart-Computer

Only when both fail, remove the machine from the domain and join it again. Rejoining a machine with the same name reuses the account, but anything that depends on the old security identifier needs checking.

How to stop it happening again

  • Do not revert a domain-joined VM to an old snapshot without a plan to repair the secure channel afterwards.
  • Keep time sync healthy, with the domain controller holding the PDC emulator role as the source.
  • Clean up stale computer accounts on a schedule, and report on machines that have not changed their password in more than 60 days.