Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having a problem with a recently reinstalled laptop with Win 7 Enterprise. The computer is complaining about a broken trust relationship when I try to grant domain users local access on the machine.

I've done the following (twice, using a different name each time) and it doesn't resolve the issue:

  1. As domain administrator, leave domain and join workgroup: WORKGROUP.
  2. Reboot.
  3. As domain administrator, join domain using new computer name.
  4. Reboot.
  5. As domain administrator, add a domain user as local administrator.
  6. Error: "The trust relationship between this workstation and the primary domain failed."

This doesn't make any sense to me. As I understand it the above process is the appropriate way to fix this issue.

So far, other symptoms I've experienced are:

The client machine says it's unable to reach the domain. Meanwhile, on the server, I see EventID 5723 from NETLOGON:

The session setup from the computer [name_of_computer] failed because there is no trust account in the security database for this computer. The name of the account referenced in the security database is [name_of_computer]$.

An inability to to ping hosts by hostname when joined to the domain. When off the domain, I can ping hosts just fine.

nslookup [fqdn] returns the proper value for both my domain controllers, and nsloookup [DC hostname] returns the proper IP for the domain controller as well.

I've checked to see that the DNS servers are being assigned properly to the clients, and they are.

I also don't believe I have any WINS servers handing out incorrect NS information. Neither Domain Controller has that role installed (though if anyone has a definitive way to check for WINS servers, that might be helpful).

Can anyone provide some further troubleshooting steps?

share|improve this question
    
what do you see in the event logs on both the dc and the workstation. –  tony roth Jul 18 '12 at 0:07
1  
possible duplicate of Windows 7 Trust issues –  MDMarra Jul 18 '12 at 0:26
    
@MDMarra I don't believe so. The accepted answer in that post does not apply here. (1) I am using computer names that didn't previously exist, (2) time is not out of sync, and (3) I have only one site and I am operating locally. Let me know if you think otherwise though because I just want to get this resolved. –  idon'twearsuits Jul 18 '12 at 0:33
2  
You asked for basic troubleshooting steps. They're the same steps. You can still have replication problems in a single site, I'd start there. –  MDMarra Jul 18 '12 at 0:58
1  
This question is accumulating enough comments trying to diagnose what's going on that it's actually tripping automated alarms. That's a good sign that it's insufficiently detailed for us to help you figure out what to do, and needs a rewrite. Please consolidate all the relevant information gained thus far into the question, then let me know, and I will clear the comment history and re-open the question to give it another shot at getting a useful answer. –  voretaq7 Jul 18 '12 at 20:02

3 Answers 3

Your next troubleshooting step is to examine the DC EventLogs for anything useful, and following that, you'll want to figure out why the computer can't "reach the domain."

You might want to reverse the order of those, and they might lead you to the same spot, but looking for errors in the EventLog is usually easier than troubleshooting your network, which is why I'd recommend starting there.

Incidentally, if the computer can't "reach the domain," how are you able to join it to the domain at all? Sounds to me like it's not properly joining to the domain, which is why the trust relationship is still broken. Haven't seen that before, honestly... but you could try changing its name when it's domain-joined to test that idea. See if the name changes in ADUC, or not (and see if it changes on all your DCs, or not - maybe there's a replication problem that's preventing the domain from recognizing the new computer account). While you're in there, you might want to check and make sure the various computer accounts you created when "rejoining" it actually show up in AD. I'm betting they didn't.

share|improve this answer
    
I left and rejoined the domain again using the latest computer name. That process went without a problem. Now being back on the domain I am no longer able to ping hosts. As you asked, how can I not ping hosts but I can authenticated against the DC to leave and rejoin the domain? I don't know but it's certainly not a physical disconnect in the network. The computer account appears in DNS and AD. I am unable to rename the computer because "network path not found" which is likely a result of the lack of connectivity in DNS. Lastly, both DCs have no errors for this computer (as of the last join). –  idon'twearsuits Jul 18 '12 at 0:40
    
Sounds like you have a GPO setting the client DNS servers to the wrong value. –  MDMarra Jul 18 '12 at 0:59
    
@MDMarra I checked that early on but the DNS servers seen by ipconfig /all are correct. –  idon'twearsuits Jul 18 '12 at 1:13
    
Yeah, that definitely sounds like a DNS error. Does nslookup return the correct value for your domain controller? (And the DC's hostname isn't longer than 15 characters, is it?) –  HopelessN00b Jul 18 '12 at 11:21
    
@HopelessN00b Yes, it does. I'm googling for this symptom but haven't found a resolution yet. It's definitely very strange. –  idon'twearsuits Jul 18 '12 at 15:58

Since you can't even ping after joining the domain, the problem is somewhere in the networking stack and has nothing to do with the trust relationship per se. (This means the usual troubleshooting steps for trust relationship errors, such as rejoining the domain, don't apply.)

My bet is that the Windows Firewall domain settings are messed up. To confirm this, turn Windows Firewall off (briefly!) and see if that lets you ping. If it does, check the settings, or try using the "Restore Defaults" option in the Windows Firewall control panel.

share|improve this answer
    
Windows firewall won't have anything to do with this. Since most of these domain functions he's talking about use name resolution (NETBIOS or DNS), that's where he needs to look, and the usual troubleshooting step do apply... at least in a normalish AD environment. –  HopelessN00b Jul 18 '12 at 11:30
    
@HopelessN00b: I don't see how you can rule out a problem with Windows Firewall. He doesn't appear to have any network connectivity at all, and Windows Firewall could certainly do that if it was configured to block outgoing traffic. –  Harry Johnston Jul 18 '12 at 19:59

Have you checked the box that says "Change primary DNS suffix when the domain membership changes"?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.