Solved

Windows 10 client lost trust relationship with 2012r2 domain

Posted on 2016-10-05
8
80 Views
Last Modified: 2016-10-28
One of the PCs we upgraded to windows 10 will not login to the domain because the machine has lost the trust relationship.
If you enter a bogus password it knows it is incorrect.
A correct password will produce the issue.

No longer have the local machine user credentials.  When trying to log into the local machine with user "administrator" and a bogus password it responds with a this account has been disabled message.

Thought I would ask if there is a resolution before rebuilding the machine from scratch.
Thanks
Karl
0
Comment
Question by:kbettencourt
8 Comments
 
LVL 30

Expert Comment

by:Scott C
ID: 41830124
Did-join the machine from the domain by joining it to a workgroup.  Make sure the machine account has been deleted from AD, then join it back in again.

You may need to power down the machine and unplug it from the wall to make sure no junk information is left in the NIC.

Ooopps...never mind...just read you don't have the local PC creds.

At this point your only option is to rebuild the machine from scratch as you said.
0
 
LVL 40

Expert Comment

by:Adam Brown
ID: 41830166
Make sure you the computer isn't attempting to log you in using the local administrator. That may be the account that is disabled. When you type in "Administrator" as your username, since Windows Vista came out and changed the login system, the login screen will default to the local administrator account if you just enter "Administrator" as your user name. You need to type in the domain if you want to log in as the domain admin. Use domain\administrator or administrator@domain.local.
0
 
LVL 30

Expert Comment

by:Rich Weissler
ID: 41830244
You can try resetting the machine account for that Windows 10 computer.  From a server logged in as an administrator:  "dsmod computer <ComputerDN> -reset"

Option 2:
I don't know if Windows 10 has the equivalent to safe mode.  Booting in safe mode in older OS would re-enable the disabled local administrator account.  (Possibly old knowledge though, I don't know for certain that it applies in Windows 10.)
1
Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

 
LVL 30

Assisted Solution

by:Rich Weissler
Rich Weissler earned 250 total points
ID: 41830257
Here's more on the 'Reset Computer account' option.  (Why, and a GUI option to accomplish.  Hint: you can do it in ADUC, right on the computer object.)  ;-))
1
 
LVL 54

Accepted Solution

by:
McKnife earned 250 total points
ID: 41830652
The computer account pw is something the client and the DCs both know and synchronize. So if you reset it at the server, the client side is unchanged. I don't see how this should help.

Donwload the pogostick bootdisk (google it) and reset  the password of the local administrator (blank it) and make the account usable (=enable it). Then logon with it and trigger a sync with the DC like this:
from an elevated powershell prompt, launch:
Reset-ComputerMachinePassword -Credential yourdom\yourdomadmin

Open in new window

(you'll be asked for the domain admin password).
Afterwards, you can login with a domain account again.
0
 
LVL 30

Expert Comment

by:Rich Weissler
ID: 41830711
If you know a domain account that was an administrator on the local box, that administrator has logged into the system, and you haven't disabled credential caching -- disconnect the NIC, and login using the domain administrator.
0
 

Author Comment

by:kbettencourt
ID: 41830884
Thanks all for the replies.  Will give it a try in the morning.
0
 

Author Comment

by:kbettencourt
ID: 41834490
Thanks.  I was able to contact the person that installed the OS and have the local machine password now.  
Also was able to get in with my domain admin account after disconnecting the NIC and booting.  That one was a simple intuitive and logical method.  
Also liked the pogostick bootdisk.  It works.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Microsoft will be releasing the Windows 10 Creators Update in just a matter of weeks. Are you prepared? Follow these steps to ensure everything goes smoothly and you don't lose valuable data on your PC.
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question