Solved

Windows 7 clients machine password reset

Posted on 2013-05-12
7
2,347 Views
Last Modified: 2013-05-14
We recently had to rebuilt a domain controller in active directory for a remote site. Some of the machines would not allow us to log onto the domain anymore.

Several of our servers at this site cited the "the trust relationship between this workstation and the domain failed". After rebuilding the domain controller I fixed the servers (server 2008 r2) by running this command

Reset-ComputerMachinePassword -Credential domain\admin -Server DomainController1

I tried to run this same command on my windows 7 clients but that didn't work. It complained about the credential parameter. I read a method for doing the same thing with NETDOM but these clients don't have netdom on them.

I also tried this script to no avial

Set objComputer = GetObject _
    ("LDAP://CN=client1,OU=clients1,OU=COMPUTERS,DC=DOMAIN1,DC=COM")
objComputer.SetPassword "client1$"

We can fix the machines by having someone at the site take them off the domain and readding them. This is not an acceptable solution since there are a bunch of problematic systems and no permanent IT staff on site.

We can't do the remove / readd to the domain remotely since as soon as the systems come off the domain the firewall turns back to defaults, and remote desktop is disabled. Also remote registry is disabled too.

Here's what I tried
> running the powershell script above over RDP by signing on with local admin
> resetting the computer account on the domain controller (right click)
> running the vbscript above

I need to reset the machine account password remotely for dozens of systems.

Thanks in advance
0
Comment
Question by:bbcac
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 6

Expert Comment

by:mrcannon
ID: 39160196
This article mentions running the netdom on UAC machines as administrator.  Did you do that (even if logged in as admin)?

http://implbits.com/About/Blog/tabid/78/post/don-t-rejoin-to-fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/Default.aspx
0
 
LVL 15

Accepted Solution

by:
Skyler Kincaid earned 500 total points
ID: 39160279
It is interesting that when you remove the computers from the domain that it disables RDP and turns the firewall back on. We have seen this a few times across our 50 clients and we always un-join and re-join them to the domain remotely.

If you un-join the computer from the domain, hit cancel when it tells you that you have to reboot now, delete the computer from AD (if it is even in there), and then re-join it right away without rebooting you will be good to go. After you re-join it you can reboot and it will still be one the domain but the computer account will be re-created.

We do this all the time and never have issues. By doing this your are re-creating the machine account in AD which is what is missing.
0
 

Author Comment

by:bbcac
ID: 39160282
These windows 7 boxes don't have netdom unfortunately
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 10

Expert Comment

by:Sam Simon Nasser
ID: 39160528
as said by xkincaiddx, just remove the join (make it as work group), restart, rejoin your domain and restart. this will remove the error (the trust relationship between this workstation and the domain failed)
0
 

Author Comment

by:bbcac
ID: 39165466
I can't restart as stated before but as  xKincaidx I just skipped the reboot and it worked like a charm. No need to remove the AD computer object. Infact it was easier to not do that.

All fixed

Thanks
0
 

Author Closing Comment

by:bbcac
ID: 39165469
no need to remove the computer object from AD
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39166148
If you remove the computer from AD it gives the computer a new SID.
0

Featured Post

PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question