How to Fix the Trust Relationship Between a Server and Domain: A Comprehensive Guide

When a server is joined to an Active Directory domain, a secure channel is established between the server and the domain controllers. This channel is used for authentication and authorization purposes. However, sometimes this trust relationship can break, leading to the error message “The trust relationship between this workstation and the primary domain failed.” This can prevent users from logging in and accessing resources on the server. In this comprehensive guide, we’ll explore various methods to fix the trust relationship between a server and domain.

Method 1: Remove and Rejoin the Server to the Domain

The quickest way to resolve the trust relationship issue is to remove the affected server from the domain and then rejoin it. Here’s how to do it:

1. Log on to the server using a local administrator account.
2. Press the Windows key R to open the Run dialog, type “sysdm.cpl,” and press Enter to open the System Properties window.
3. Click on the “Computer Name” tab and then click on the “Change” button.
4. Under the “Member of” section, select “Workgroup” and enter a workgroup name.
5. Click “OK” and restart the server when prompted.
6. After the server has restarted, open the System Properties window again and click on the “Change” button.
7. Under the “Member of” section, select “Domain” and enter the domain name.
8. Click “OK” and enter the credentials of a user who has permissions in the domain.
9. Click “OK” and restart the server when prompted.

After the server has restarted, the trust relationship should be restored, and users should be able to log in without any issues.

Method 2: Reset the Computer Account Password

Another method to fix the trust relationship issue is to reset the computer account password in Active Directory. Here’s how to do it:

1. Log on to a domain controller using an account with administrative privileges.
2. Open the Active Directory Users and Computers snap-in.
3. Navigate to the “Computers” container and locate the affected server.
4. Right-click on the server’s computer object and select “Reset Account.”
5. Click “Yes” to confirm the action.

After resetting the computer account password, the server will need to be restarted to establish a new secure channel with the domain controllers.

Method 3: Use PowerShell to Repair the Secure Channel

If you have access to a PowerShell prompt on the affected server, you can use the `Test-ComputerSecureChannel` cmdlet to test and repair the secure channel. Here’s how to do it:

1. Log on to the server using a local administrator account.
2. Open an elevated PowerShell prompt by right-clicking on the Start menu and selecting “Windows PowerShell (Admin).”
3. Run the following command to test the secure channel:

Test-ComputerSecureChannel -Verbose

If the secure channel is broken, the command will return `False`.

4. Run the following command to repair the secure channel:

Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

This command will prompt you for domain administrator credentials and then repair the secure channel.

After running the repair command, the server should be able to communicate with the domain controllers, and users should be able to log in without any issues.

Method 4: Use the System File Checker Tool

In some cases, the trust relationship issue may be caused by corrupted system files. You can use the System File Checker (SFC) tool to scan and repair these files. Here’s how to do it:

1. Log on to the server using a local administrator account.
2. Open an elevated Command Prompt by right-clicking on the Start menu and selecting “Command Prompt (Admin).”
3. Run the following command to scan and repair system files:

sfc /scannow

The SFC tool will scan the system files and automatically repair any corrupted files it finds.

After running the SFC tool, restart the server and check if the trust relationship issue has been resolved.

Conclusion

The trust relationship between a server and domain is crucial for authentication and authorization purposes. When this relationship breaks, it can lead to various issues, such as users being unable to log in or access resources on the server. In this guide, we’ve explored four methods to fix the trust relationship issue: removing and rejoining the server to the domain, resetting the computer account password, using PowerShell to repair the secure channel, and using the System File Checker tool to scan and repair corrupted system files.

By following these methods, you should be able to resolve the “The trust relationship between this workstation and the primary domain failed” error and restore the trust relationship between the server and domain. If the issue persists after trying these methods, it’s recommended to consult with a domain expert or Microsoft support for further assistance.