Home / server / Questions / 408678
In Process
Chris76786777
Asked: 2012-07-18 16:03:55 +0800 CST

Broken trust relationship not corrected even after leaving and joining domain with new computer name

  • 772

I am having a problem with a recently reinstalled laptop with Win 7 Enterprise. The computer is complaining about a broken trust relationship when I try to grant domain users local access on the machine.

I've done the following (twice, using a different name each time) and it doesn't resolve the issue:

  1. As domain administrator, leave domain and join workgroup: WORKGROUP.
  2. Reboot.
  3. As domain administrator, join domain using new computer name.
  4. Reboot.
  5. As domain administrator, add a domain user as local administrator.
  6. Error: "The trust relationship between this workstation and the primary domain failed."

This doesn't make any sense to me. As I understand it the above process is the appropriate way to fix this issue.

So far, other symptoms I've experienced are:

The client machine says it's unable to reach the domain. Meanwhile, on the server, I see EventID 5723 from NETLOGON:

The session setup from the computer [name_of_computer] failed because there is no trust account in the security database for this computer. The name of the account referenced in the security database is [name_of_computer]$.

An inability to to ping hosts by hostname when joined to the domain. When off the domain, I can ping hosts just fine.

nslookup [fqdn] returns the proper value for both my domain controllers, and nsloookup [DC hostname] returns the proper IP for the domain controller as well.

I've checked to see that the DNS servers are being assigned properly to the clients, and they are.

I also don't believe I have any WINS servers handing out incorrect NS information. Neither Domain Controller has that role installed (though if anyone has a definitive way to check for WINS servers, that might be helpful).

Can anyone provide some further troubleshooting steps?

windows active-directory

4 Answers

  1. Your next troubleshooting step is to examine the DC EventLogs for anything useful, and following that, you'll want to figure out why the computer can't "reach the domain."

    You might want to reverse the order of those, and they might lead you to the same spot, but looking for errors in the EventLog is usually easier than troubleshooting your network, which is why I'd recommend starting there.

    Incidentally, if the computer can't "reach the domain," how are you able to join it to the domain at all? Sounds to me like it's not properly joining to the domain, which is why the trust relationship is still broken. Haven't seen that before, honestly... but you could try changing its name when it's domain-joined to test that idea. See if the name changes in ADUC, or not (and see if it changes on all your DCs, or not - maybe there's a replication problem that's preventing the domain from recognizing the new computer account). While you're in there, you might want to check and make sure the various computer accounts you created when "rejoining" it actually show up in AD. I'm betting they didn't.

    • 1

  2. Since you can't even ping after joining the domain, the problem is somewhere in the networking stack and has nothing to do with the trust relationship per se. (This means the usual troubleshooting steps for trust relationship errors, such as rejoining the domain, don't apply.)

    My bet is that the Windows Firewall domain settings are messed up. To confirm this, turn Windows Firewall off (briefly!) and see if that lets you ping. If it does, check the settings, or try using the "Restore Defaults" option in the Windows Firewall control panel.

    • 0

  3. Have you checked the box that says "Change primary DNS suffix when the domain membership changes"?

    • 0
    1. update the drivers on the local workstation NIC
    2. then delete the computer out of AD refresh
    3. then re add to the Domain...

    If that doesn't work, check GPO next.

    • -1