The Trust relationship between the workstation and Domain Failed -Win7

[sharpharp]

Hi all,

Over the last week or so, we have experienced an epidemic of Windows 7 PCs displaying the message "The trust relationship between this workstation and the primary domain has failed".

We have had to manually unjoin and rejoin over 140+ PCs in the last week alone, however some of these same PCs have the same message re-occuring again today...

So i'm in a rut here, why are the Pcs coming back up with the same Trust message when we already manually fixed them last week....

Need urgent help to fix this.

 

[sharpharp]

Bumped up, anyone any ideas on this?

 

[chev65]

From what I found you need to set up Active Directory on the Domain level and add the trusted Users there.

I've googled around and that is the only fix I can find besides unjoining and rejoining which doesn't seem to be a long term fix. The problem was probably caused by one of those famous Windows updates.

The trust relationship between this workstation and primary domain - Microsoft Answers

 

[2xg]

Hi sharpharp,

In addition, can you post an ipconfig /all output of one the problematic computers?

I've only seen this on one computer's here at my work which was running Vista at that time, but not on any XP and Windows 7 computers.

Verify that the DNS is pointing to the Private IP from a DNS Server configured in one of your Windows Servers - this is your Server's IP address and not ponting to the external DNS Address provided by your provider.

 

[sharpharp]

I was also thinking it could be a rogue Windows Update, as it seems to be happened to all the PCs on one floor which were imaged recently and are a different spec, HP elite 8200.

When rolling this image out, I updated the windows patches (as u do) but they all went in fine initially, then after a few days they have been dropping out one by one...

IP and DNS is ok, as it is the same DHCP Setup for all the floors of PCS we have.

 

[englase]

Interesting

I just began deploying some new W7 boxes this week and I had one fall off of the domain this morning. I am assuming my issue was update related as well, seeing that everything was fine on the other end.

 

[chev65]

You need to setup Active Directory and then add users there,

*Username:
*Password:

in some schools they setup this on the server level, and they have disks
for each student, so once they logon and join this domain, they will have
a shared disk in “my computer” where they store everything, but once they
logoff that machine everything stored on the local C:\ disk will be erased (deleted)
once you log back on to Windows® everything is gone, and the PC is using the
default background and settings.

Read more: The trust relationship between this workstation and primary domain - Microsoft Answers

This seems to be the only reasonable answer for this problem. No doubt a Security update of some kind but can't really test this out on my end.

 

[sharpharp]

You need to setup Active Directory and then add users there,

*Username:
*Password:

in some schools they setup this on the server level, and they have disks
for each student, so once they logon and join this domain, they will have
a shared disk in “my computer” where they store everything, but once they
logoff that machine everything stored on the local C:\ disk will be erased (deleted)
once you log back on to Windows® everything is gone, and the PC is using the
default background and settings.

Read more: The trust relationship between this workstation and primary domain - Microsoft Answers

This seems to be the only reasonable answer for this problem. No doubt a Security update of some kind but can't really test this out on my end.

Hi,

This has nothing to do with Users or shared disks, this is about the PCs themselves coming up with the trust relationship error.

 

[chev65]

You need to setup Active Directory and then add users there,

*Username:
*Password:

in some schools they setup this on the server level, and they have disks
for each student, so once they logon and join this domain, they will have
a shared disk in “my computer” where they store everything, but once they
logoff that machine everything stored on the local C:\ disk will be erased (deleted)
once you log back on to Windows® everything is gone, and the PC is using the
default background and settings.

Read more: The trust relationship between this workstation and primary domain - Microsoft Answers

This seems to be the only reasonable answer for this problem. No doubt a Security update of some kind but can't really test this out on my end.

Hi,

This has nothing to do with Users or shared disks, this is about the PCs themselves coming up with the trust relationship error.

I believe that was just an example.

Seems like they are referring to adding the User names and passwords to the active directory on the actual domain server.

This problem seems to be fairly wide spread although I did find a couple of sites with some working solutions.
http://www.petenetlive.com/KB/Article/0000504.htm

Lots of people here with the same problem, showing a few solutions but the link above looks to be the best one.
http://dailytweak.wordpress.com/201...is-workstation-and-the-primary-domain-failed/

 

[icono]

Shortcut

I may not be able to prevent the problem (seems that nobody can) but this should speed up the recovery from it. We use altiris for management and it is able to still communicate with clients that have dropped off the domain and run commands using the system account. Using it, I can send these two commands via cmd script and have it remove the old computer account and rejoin without having to logon. The semicolons designate where normally the next line of powershell code would start and allow for a single command to be used instead.

Powershell -command $pass = convertto-securestring "PlainTextPW" -asplaintext -force;$domaincred = new-object system.management.automation.pscredential 'd204\d204joiner',$pass;remove-computer -credential $domaincred -force
 
Powershell -command $pass = convertto-securestring "PlainTextPW" -asplaintext -force;$domaincred = new-object system.management.automation.pscredential 'd204\d204joiner',$pass;add-computer -credential $domaincred -domainname 'd204.ipsd.net'

 

[Dave Atkin]

Hello,

You need to start doing some trouble shooting within Active Directory.

What is the OS of the Server? Has any recent changes been made? Have you migrated to another server? How many servers? If more than one, are they replicating?

Please provide an ipconfig /all of the problem PC and an ipconfig /all of the Server.

On the Server open CMD and type Dcdiag to diagnose the domain state. If its windows Server 2003 or earlier then you will have to download the windows support tools found here:
Download: Windows Server 2003 Service Pack 2 32-bit Support Tools - Microsoft Download Center - Download Details


Dave

 

[mulderlr]

It doesn't appear to be a domain issue. Why look there all of a sudden? I have a simple 2008R2 domain in native mode - no replication, no changes in weeks. All of a sudden a windows 7 pro 64bit machine that was joined in, "crashes" or whatever. User reboots it and no more trust relationship. I assume it was trying to install updates since there are pending updates on the login screen that didn't finish, but now local accounts nor network accounts work. This is a dell computer. I will have to boot from CD and try to reset local account passwords to get in and chkdsk the things and pull logs to be sure, but from what I can gather in this thread, these aren't people with domain issues!

 

[Dave Atkin]

If the trust relationship between a PC and the domain controller fails its because it isn't authenticating correctly. You can't rule out a DC problem without looking into it.

There are a lot of reasons for why this happens. I had one a few weeks ago which was cause due to a duplicate Computer name on the network. Two PC's tried to authenticate with AD which caused the trust to fail.

Do the Dcdiag and post the results

 

[sharpharp]

Hi all,

I re-imaged a whole floor (140) Windows PCs with a fully updated image with the latest windows patches on it. All were done last week. Just today i've had reports that out of 12 randomly checked PCs, 8 of them came up with the trust relationship error............AHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

Ok, need to get to the bottom of this, can anyone help troubleshoot this, can post any logs or stats if needed.

 

[Dave Atkin]

Hello,

Please start a new thread for your question.

If its only 8 PC's then I would re-join the domain to see if that sorts it. Check the Computer names to make sure they are not the same.

If it doesn't fix it then you need to look at the DC's event logs.

 

[sharpharp]

Thats 8 randomly today!!!! Over the past month we have MANUALLY rejoined the said PCs back into the domain, and then again they fall again a few days later.

We are regularly having to rejoin the SAME PCs back into the domain, so I need a fix for this which is permenant not something that we have to keep fixing on a daily basis.

 

[Dave Atkin]

Have you checked the PC names? tried renaming the PC and then joining it back onto the domain?

Are they all connected to the same switch? - Frequent disconnections could cause the problem.

 

[sharpharp]

the pc name is correct, and yes we've joined the pc back to the domains 100's of times.... that is no joke, we are sick and tired of keep having to do this.

I am sat next to two PCs, both with same image, one has the trust error, the other doesn't. Identical image, same DNS/DHCP settings. Ipconfig is the same. The PCs are both in the same switch as well.

On the broken one, in the event log under system there is event 3210's...

This computer could not authenticate with \\******* , a Windows domain controller for domain *******, and therefore this computer might deny logon requests. This inability to authenticate might be caused by another computer on the same network using the same name or the password for this computer account is not recognized. If this message appears again, contact your system administrator.

I can login locally into the broken PC, internet access is fine etc, so what the hell can this be?????

 

[chev65]

Maybe the TechNet solution will help. This one has to do with the Certification Authority services.

The trust relationship between this workstation and the primary domain failed

 

[sharpharp]

Tried that link, but not relevant to what I have happening here.

Also set the Machine Password Maximum Age to 999 using GPO
Since then it was quiet, but surely enough we've had another 10 fail today...

Surely I can't be the only experiencing this...