Solved

Windows 7 clients machine password reset

Posted on 2013-05-12
7
2,384 Views
Last Modified: 2013-05-14
We recently had to rebuilt a domain controller in active directory for a remote site. Some of the machines would not allow us to log onto the domain anymore.

Several of our servers at this site cited the "the trust relationship between this workstation and the domain failed". After rebuilding the domain controller I fixed the servers (server 2008 r2) by running this command

Reset-ComputerMachinePassword -Credential domain\admin -Server DomainController1

I tried to run this same command on my windows 7 clients but that didn't work. It complained about the credential parameter. I read a method for doing the same thing with NETDOM but these clients don't have netdom on them.

I also tried this script to no avial

Set objComputer = GetObject _
    ("LDAP://CN=client1,OU=clients1,OU=COMPUTERS,DC=DOMAIN1,DC=COM")
objComputer.SetPassword "client1$"

We can fix the machines by having someone at the site take them off the domain and readding them. This is not an acceptable solution since there are a bunch of problematic systems and no permanent IT staff on site.

We can't do the remove / readd to the domain remotely since as soon as the systems come off the domain the firewall turns back to defaults, and remote desktop is disabled. Also remote registry is disabled too.

Here's what I tried
> running the powershell script above over RDP by signing on with local admin
> resetting the computer account on the domain controller (right click)
> running the vbscript above

I need to reset the machine account password remotely for dozens of systems.

Thanks in advance
0
Comment
Question by:bbcac
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 6

Expert Comment

by:mrcannon
ID: 39160196
This article mentions running the netdom on UAC machines as administrator.  Did you do that (even if logged in as admin)?

http://implbits.com/About/Blog/tabid/78/post/don-t-rejoin-to-fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/Default.aspx
0
 
LVL 15

Accepted Solution

by:
Skyler Kincaid earned 500 total points
ID: 39160279
It is interesting that when you remove the computers from the domain that it disables RDP and turns the firewall back on. We have seen this a few times across our 50 clients and we always un-join and re-join them to the domain remotely.

If you un-join the computer from the domain, hit cancel when it tells you that you have to reboot now, delete the computer from AD (if it is even in there), and then re-join it right away without rebooting you will be good to go. After you re-join it you can reboot and it will still be one the domain but the computer account will be re-created.

We do this all the time and never have issues. By doing this your are re-creating the machine account in AD which is what is missing.
0
 

Author Comment

by:bbcac
ID: 39160282
These windows 7 boxes don't have netdom unfortunately
0
Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

 
LVL 10

Expert Comment

by:Sam Simon Nasser
ID: 39160528
as said by xkincaiddx, just remove the join (make it as work group), restart, rejoin your domain and restart. this will remove the error (the trust relationship between this workstation and the domain failed)
0
 

Author Comment

by:bbcac
ID: 39165466
I can't restart as stated before but as  xKincaidx I just skipped the reboot and it worked like a charm. No need to remove the AD computer object. Infact it was easier to not do that.

All fixed

Thanks
0
 

Author Closing Comment

by:bbcac
ID: 39165469
no need to remove the computer object from AD
0
 
LVL 15

Expert Comment

by:Skyler Kincaid
ID: 39166148
If you remove the computer from AD it gives the computer a new SID.
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article helps those who get the 0xc004d307 error when trying to rearm (reset the license) Office 2013 in a Virtual Desktop Infrastructure (VDI) and/or those trying to prep the master image for Microsoft Key Management (KMS) activation. (i.e.- C…
Windows 10 Creator Update has just been released and I have it working very well on my laptop. Read below for issues, fixes and ideas.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

632 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question