The trust relationship between this workstation and the primary domain failed.

Hello there,

I am getting the following error on workstation running Win7 SP1:
The trust relationship between this workstation and the primary domain failed.

I have found a lot of solutions mainly saying to unjoin and the join domain name. I was able to login to desktop when unplugin and then pluging LAN cable again.

But my main goal is to rejoin WITHOUT LOOSING the desktop and setting under that user login. I remember that one time i unjoined and joined and then I got completey new desktop.

Can you suggest more safer solution?

Regards.
celjan79Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Spike99On-Site IT TechnicianCommented:
Dropping the Pc from the domain & rejoining it is the only way to resolve that issue.
Once you rejoin the PC to the domain, the user profile info for any domain accounts should still be on the PC.
0
celjan79Author Commented:
So the best thing to do is:
- unplug the LAN cable
- login to user account
- plug the LAN cable back
- unjoing from domain (joining to workgroup)
- then without restart / logoff again joing to domain
- restarting
- loging on

Is this correct?
0
Gabriel CliftonNet AdminCommented:
Check DNS, especially if unplugging the network cable and putting it back in fixes the issue. DNS most of the time is the problem, but not every time. If you find NO issues with DNS then your only option is unjoin rejoin domain.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

celjan79Author Commented:
Gabriel Clifton: What do you mean regarding the DNS? I have 20 PC on the same LAN and nobody has problems with loging on.
If you mean local DNS on this machine. The internet is working, I can see network drives when plugin LAN back in. What test do you suggest?
0
Gabriel CliftonNet AdminCommented:
When the system is not communicating with the domain, log into the machine locally, no domain, and check dns settings on the computer, check to ensure network is functioning properly on the computer. See if you can communicate with DC and see if the DC can communicate with the computer. Check the DNS records on your server to make sure the computer is listed properly. Check system logs to see if it is reporting what your issue is.
0
Spike99On-Site IT TechnicianCommented:
Which account are you using to log on?  There's no need to unplug the network cable if you log on using a local admin account.  

Here's what I would do:
- Log on with local admin account
- join PC to a work group (call it anything you like)
- reboot when prompted
- log back on to the pc as local admin
- join the pc to the domain
- reboot when prompted
- after the PC boots back up this time, you should be able to log on to the PC with a domain user account

From my experience, DNS hasn't been the cause of failed trust relationships.  I've seen it happen when someone reset the machine's account in active directory or when someone accidentally deleted the machine account from actiive directory.  I also caused it myself one time when I accidentally gave 2 PCs the same name: I got trust failures on both machines. I had to drop both from the domain & then rejoin them both.

A few times we did get a failure of the trust relationship error when we couldn't figure out the cause, but in those cases I don't think DNS issues were to blame because there was no problem communicating with the DC at that time.
0
celjan79Author Commented:
When I use local account to login (switch user option) - like "computername\user" I get the same error like before:
The trust relationship between this workstation and the primary domain failed.

Do I need to do this with LAN cable pluged out?
0
Gabriel CliftonNet AdminCommented:
If you are using computername\user you will need to unplug, if you are using computername\Administrator you should not have to unplug, but you may need to.
0
celjan79Author Commented:
So to make it clear - this should work:
- login as local administrator (user: administrator); unplug if needed
- unjoin domain by joining to workgroup
- restart
- login again as local "administrator"
- join the domain
- restart
- login as user you worked as before on that workstation

And this should result in working desktop and apps without reinstalling and resetting?
0
Spike99On-Site IT TechnicianCommented:
That should work without re-installing. The settings for each domain user will still be there & should work again once the machine is re-joined to the domain.
0
celjan79Author Commented:
When I login back with local administrator under workgroup, what user should I use to join? The user that work on that workstation and will then login or domain administrator?
0
Gabriel CliftonNet AdminCommented:
A user should not have the ability to join a domain. Use an administrator account.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
great_gentle_manCommented:
hi,
this happened to one of my clients, few months back, used instructions in below link to resolve quickly.

http://blog.blksthl.com/2013/03/18/fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/
0
celjan79Author Commented:
Thanks for support. It worked :)
0
Spike99On-Site IT TechnicianCommented:
Great, I'm glad we could help!

FYI for future reference, when joining a workgroup computer to a domain, you need to be logged on with a local admin account. But, when prompted, you need to enter the credentials of a domain account which has rights to join the PC to the domain.  Any member of the domain admins group will do, but other users can join up to 10 PCs to the domain.

On this page, http://technet.microsoft.com/en-us/library/cc780195(v=ws.10).aspx, MS says:
       "By default, any authenticated user has this right and can create up to 10 computer accounts in the domain."
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.