Trust Relationship Failed: Fix Guide

If you see a “trust relationship failed” error when logging into a Windows computer joined to an Active Directory domain, the computer’s machine account password no longer matches the one stored in the domain. The fix is to re-establish the trust by resetting the machine account password, either with a local admin account or through PowerShell.

What Causes the Trust Relationship to Fail

Every domain-joined computer has a machine account (a computer object) in Active Directory. That object holds a password that is automatically rotated every 30 days by default. The trust fails when the computer and the domain controller disagree on that password. Common causes include:

• Restoring a VM snapshot taken before the password was last changed.
• Cloning a virtual machine without running Sysprep.
• Rejoining the computer to a different domain or the same domain with a different name.
• Manually resetting the machine account password in AD.
• Time skew greater than 5 minutes between the client and domain controller.

How the Machine Account Password Works

Windows uses a shared secret for computer authentication, similar to how a user password works. The machine password is stored in the Local Security Authority (LSA) secrets on the client and in the unicodePwd attribute of the computer object in AD. The NetLogon service handles the authentication. When you log in, the domain controller verifies the password hash. If they don’t match, you get the classic error: “The trust relationship between this workstation and the primary domain failed.”

Fix 1: Rejoin the Domain (Most Reliable)

This method always works but requires a local administrator account and knowledge of domain credentials.

1. Log in with the local administrator account (use .\Administrator if you don’t know the local username).
2. Open System Properties (Win + R, type sysdm.cpl).
3. Click Change under “To rename this computer or change its domain.”
4. Select Workgroup, enter any name (e.g., WORKGROUP), and click OK. Restart.
5. Log in again as local admin, go back to System Properties, select Domain, enter your domain name, and provide a domain account with permission to join computers.
6. Restart again. The trust is recreated with a fresh machine password.

Fix 2: Reset the Machine Account with PowerShell

If you have a domain admin account, you can reset the machine password remotely without rejoining.

1. From a domain controller or a machine with RSAT tools, open PowerShell as administrator.
2. Run: Reset-ComputerMachinePassword -Server DC01 -Credential DOMAIN\Admin
3. If that fails, use the NetDom command: netdom resetpwd /s:DC01 /ud:DOMAIN\Admin /pd:*

These commands force the client to change its machine password with the specified domain controller. After running, restart the client and try logging in with a domain account.

Fix 3: Offline Registry Edit (No Local Admin)

If you don’t know the local admin password, you can edit the registry offline using a Windows installation media.

1. Boot from the Windows installation USB, click “Repair your computer.”
2. Open Command Prompt (Shift+F10).
3. Find the Windows drive (usually D:). Run regedit and select HKEY_LOCAL_MACHINE.
4. Load the hive: File > Load Hive, browse to D:\Windows\System32\config\SAM, name it temp.
5. Navigate to temp\SAM\Domains\Account\Users\000001F4 (the Administrator account).
6. Delete the F and V values. Unload the hive, reboot, and log in with a blank password for the built-in Administrator.

This clears the local password so you can log in and rejoin the domain. It works only for the built-in Administrator, not other local accounts.

Prevention and Best Practices

• Always run sysprep before cloning a VM.
• Avoid reverting to old snapshots; if you must, reset the machine password afterward.
• Keep the client’s clock synced to the domain time source (use w32tm /resync).
• Ensure the computer object isn’t accidentally deleted or disabled in AD.
• If you have many machines, consider a scheduled script that runs Test-ComputerSecureChannel and resets if needed.

Frequently Asked Questions

Can I fix this without a local admin account?

Yes, the offline registry method works if you have physical access and a Windows installation USB. Alternatively, a domain admin can reset the machine password remotely, but you still need to log in locally to run the command unless you use a remote tool like PowerShell remoting (which also requires local admin).

Will rejoining the domain delete user profiles?

No, rejoining the domain does not delete local user profiles. However, domain user profiles may not load automatically if the SID changes. Usually, the SID stays the same, but it’s safer to back up important data.

How long does the machine password last?

By default, Windows changes the machine account password every 30 days. This is controlled by the domain policy “Domain member: Maximum machine account password age.”

What is the difference between “trust relationship failed” and “access denied”?

“Trust relationship failed” specifically means the machine password is wrong. “Access denied” usually means the user credentials are wrong or the account lacks permission. The error text often says “The trust relationship between this workstation and the primary domain failed.”

Does this happen on Azure AD joined devices?

No, Azure AD joined devices use a different authentication mechanism (certificate-based). This error is specific to on-premises Active Directory domain joins.

Related

• Compare AI Coding Tools: Privacy, Pricing, Team Use
• Xiaomi Phone Flickering Issue: Causes & Fixes
• Roll Your Height Codes: Meaning & How It Works