Solved

Windows 7 clients machine password reset

Posted on 2013-05-12
7
2,335 Views
Last Modified: 2013-05-14
We recently had to rebuilt a domain controller in active directory for a remote site. Some of the machines would not allow us to log onto the domain anymore.

Several of our servers at this site cited the "the trust relationship between this workstation and the domain failed". After rebuilding the domain controller I fixed the servers (server 2008 r2) by running this command

Reset-ComputerMachinePassword -Credential domain\admin -Server DomainController1

I tried to run this same command on my windows 7 clients but that didn't work. It complained about the credential parameter. I read a method for doing the same thing with NETDOM but these clients don't have netdom on them.

I also tried this script to no avial

Set objComputer = GetObject _
    ("LDAP://CN=client1,OU=clients1,OU=COMPUTERS,DC=DOMAIN1,DC=COM")
objComputer.SetPassword "client1$"

We can fix the machines by having someone at the site take them off the domain and readding them. This is not an acceptable solution since there are a bunch of problematic systems and no permanent IT staff on site.

We can't do the remove / readd to the domain remotely since as soon as the systems come off the domain the firewall turns back to defaults, and remote desktop is disabled. Also remote registry is disabled too.

Here's what I tried
> running the powershell script above over RDP by signing on with local admin
> resetting the computer account on the domain controller (right click)
> running the vbscript above

I need to reset the machine account password remotely for dozens of systems.

Thanks in advance
0
Comment
Question by:bbcac
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 6

Expert Comment

by:mrcannon
ID: 39160196
This article mentions running the netdom on UAC machines as administrator.  Did you do that (even if logged in as admin)?

http://implbits.com/About/Blog/tabid/78/post/don-t-rejoin-to-fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/Default.aspx
0
 
LVL 15

Accepted Solution

by:
Skyler Kincaid earned 500 total points
ID: 39160279
It is interesting that when you remove the computers from the domain that it disables RDP and turns the firewall back on. We have seen this a few times across our 50 clients and we always un-join and re-join them to the domain remotely.

If you un-join the computer from the domain, hit cancel when it tells you that you have to reboot now, delete the computer from AD (if it is even in there), and then re-join it right away without rebooting you will be good to go. After you re-join it you can reboot and it will still be one the domain but the computer account will be re-created.

We do this all the time and never have issues. By doing this your are re-creating the machine account in AD which is what is missing.
0
 

Author Comment

by:bbcac
ID: 39160282
These windows 7 boxes don't have netdom unfortunately
0
Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 10

Expert Comment

by:Sam Simon Nasser
ID: 39160528
as said by xkincaiddx, just remove the join (make it as work group), restart, rejoin your domain and restart. this will remove the error (the trust relationship between this workstation and the domain failed)
0
 

Author Comment

by:bbcac
ID: 39165466
I can't restart as stated before but as  xKincaidx I just skipped the reboot and it worked like a charm. No need to remove the AD computer object. Infact it was easier to not do that.

All fixed

Thanks
0
 

Author Closing Comment

by:bbcac
ID: 39165469
no need to remove the computer object from AD
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39166148
If you remove the computer from AD it gives the computer a new SID.
0

Featured Post

Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question