Error: The trust relationship between this workstation and the primary domain failed
Article ID: CTX227147
Updated On:
Description
Users cannot log on to a system using Active Directory credentials and the following error message appears:
"The trust relationship between this workstation and the primary domain failed.”
This issue is seen when the session logon is attempted through Remote Desktop Protocol, ICA, or directly at the console. Only logons using local accounts are successful. The underlying problem when this error is seen is that the machine you are trying to access can no longer communicate securely with the Active Directory domain to which it is joined.
Environment
Resolution
First, determine which component is having the issue. Then use the repair method that works best for your environment.
Provisioning Services Server, XenDesktop or XenApp Delivery Controller or XD/XA VDA: (Warning ! Never use Option 1 to reset machine account password for a PVS Target Device. See "Provisioning Services Target Device" under Option 4.)
Option 2: Reset via PowerShell
There are a number of different ways this can be done via PowerShell from the local machine and from an AD DC.
Here are a couple options:
Reset-ComputerMachinePassword
Test-ComputerSecureChannel –Repair
ii) Open the Windows System properties
iii) Change: “domain.net” to just “domain”
1. Logon to the machine with a local administrator account.
2. Obtain the tool netdom.exe from Windows Server 2008 or Windows Server 2008 R2 CD to enable the Active Directory Domain Services role.
3. Note: For Windows Vista and Windows 7, utilize the Remote Server Administration Tools (RSAT) to enable the Active Directory Domain Services role.
4. Run netdom.exe to change the password.
5. Open command prompt with administrator rights.
6. Execute the command: netdom.exe resetpwd /s:<server> /ud:<user> /pd:*
7. Restart the machine
Provisioning Services Target Device
The brokern Domain Trust Relationship usually occurs in PVS due to the database containing an old password. This will happen if you initiate a password reset directly from Active Directory or the Target Device. Only resolve this using the PVS Console.
Make sure that you have configured the PVS environment properly.
Reference the following article: https://support.citrix.com/article/CTX132289
Once that is confirmed. Shut the target device down and reset the machine account password for the affected target device in the PVS console.
Problem Cause
This can happen for a number of reasons. This article address the situations where the machine account password needs to be reset. These are the non-destructive methods for fixing the most common causes for the trust relationship issue.For example:
- Machine was disjoined and rejoined to the domain in PVS/MCS environment which discard all changes on reboot.
- Machine was restored to a system restore point or to a snapshot that is old enough to have a different machine account password than the one currently in use by AD.
- More than one machine on a network with the same hostname.
- AD Machine account object corruption.
- AD policy that would disable a computer after x number of days of not authenticating.
- Computer object in AD is deleted.
Issue/Introduction
Additional Information
