Fix Active Directory Trust Relationship Issues

ℹ️

Typical error: "The trust relationship between this workstation and the primary domain failed." This means the machine account password is out of sync with the domain controller.

Diagnosis

Confirm the Trust Issue

Test-ComputerSecureChannel -Verbose

If this returns False, the secure channel is broken and needs to be repaired.

Fix 1

Repair Secure Channel (No Rejoin Needed)

The quickest fix — reset the machine account password without removing the device from the domain.

# Run as Domain Admin on the affected machine:
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

# Or using netdom:
netdom resetpwd /server:<DC-name> /userd:DOMAIN\Administrator /passwordd:*

Fix 2

Rejoin the Domain

If the secure channel repair doesn't work, remove and rejoin the domain. Log in with a local admin account first.

# Remove from domain (use local admin creds):
Remove-Computer -WorkgroupName WORKGROUP -Restart -Force

# After reboot, rejoin:
Add-Computer -DomainName "yourdomain.com" `
  -Credential (Get-Credential) `
  -OUPath "OU=Computers,DC=yourdomain,DC=com" `
  -Restart

Fix 3

Reset Machine Account from DC

If you can't log on at all, reset the machine account from a Domain Controller, then force a password sync.

# On the Domain Controller (run as Domain Admin):
Reset-ComputerMachinePassword -Server <DC-name> -Credential (Get-Credential)

# Or via ADUC:
# Active Directory Users and Computers → find computer → right-click → Reset Account

Ways to Fix Active Directory Trust Relationship Issues