You receive an error indicating the trust relationship between a workstation and domain has failed.
There are a variety of reasons why this can occur; the commonality being the machine’s password was unable to renew with a DC (this is a CLIENT-initiated event). For example, a VM has been reset to a snapshot from > 90 days ago (greater than 2 password iterations) or a GPO that prevents the password update. Another possible cause is a restore (authoritative or nonauthoritative) of a DC.
NOTE: Leaving a machine off the domain for an extended period of time will not cause this issue. Once a machine has reconnected to the domain, the password, regardless of age, will update. If a trust relationship fails in this case, the fact it was off the domain for an extended period is correlative, not causative.
To resolve this issue you need to either rejoin the computer to the domain (using the Old-Timey Method) or reset the machine password.
The following method can be performed on the machine throwing the error and does not require a reboot. This method does require PowerShell (WMF) version 3 or greater.
First, you can test whether the machine has lost the trust relationship. Open an elevated PowerShell prompt and run the following:
If the trust relationship is broken, you will get a return of 'false'. If the trust relationship is not broken, you will get a return of 'true'.
If the trust relationship is broken, you can correct this by running one of the following from an elevated PowerShell prompt on the impacted machine:
Reset-ComputerMachinePassword -Credential (Get-Credential) -Server [DomainController]
- Credentials are supplied in the usual domain\username format.
- In certain cases, the above PowerShell will not work, even if all prerequisites have been met. In that case, you will most likely need to manually remove/add the machine to the domain or use the netdom.exe utility. You can manually add or remove/add machines using PowerShell as well. For example (change SomeDomain to your domain),
Remove-Computer -Credential (Get-Credential) -Force
Add-Computer -DomainName SomeDomain -Restart -Force