Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is wrong:

I am trying to join a server to the domain. I was able to join it, restart the server, and when I tried to log in, I got the error:

Trust Relationship Between Workstation and Domain Fails

Working from this this article, I ran the following commands:

Test-computersecurechannel -verbose

Test-computersecurechannel -repair -verbose

and got the following output:

The secure channel between the local computer and the domain (domain name) is broken.

The attempt to repair the secure channel between the local computer and the domain (domain name) has failed.

What I've tried:

I tried rejoining to the domain. I tried reseting the computer account in AD and rejoining the domain. I tried recreating the computer account and rejoining to the domain.

How do I fix this? Is this a DC Replication issue?

I am running Windows 2012.


Just found this: the server time is off. CMOS clock is the time source (as a vm). Set CMOS, but this didn't fix the issue...

share|improve this question
By resetting the computer account in AD what do you mean? What I would try is (and if you've already done this forgive me, but I wasn't clear on what you said on the last part of your question) unjoin the computer from the domain > delete the computer account from AD > force replication (AD Sites and Services) > then rejoin to the domain and force replication again. Let me know the results of this and we can troubleshoot further if needed. – Brad Bouchard May 5 '14 at 15:57
When I said reset the computer account, I mean I looked it up in AD and right clicked the compuer object and clicked reset computer account. I have tried what you said, but I'll try it again in case I missed something. – Jeff May 5 '14 at 16:03
@BradBouchard tried what you suggested... No luck. – Jeff May 5 '14 at 16:11
Please do. Let me know the results then too. I have a meeting to go to but can help you in about 30-45 minutes if what I suggested doesn't fix it. – Brad Bouchard May 5 '14 at 16:12
Two things: 1) Try doing my steps again, but when you join it to the domain give the computer a different name just as a test. 2) Try joining another new computer to the domain and see what the results are. – Brad Bouchard May 5 '14 at 17:03
up vote 1 down vote accepted

You need to reset the machine account password for the computer in question.

First, make sure the ports listed here are open on your network between the server and the Domain Controllers.

Then, run this command from an elevated (Right-click > Run As Administrator) Command Prompt:

Netdom reset computer /domain:domainname /userd:domainadmin /passwordd:password

Where computer is the computer having trouble with its trust relationship. The username you use should be a domain admin.

Follow the steps here if you get lost.

Also, make sure that there aren't issues with the SPN. See here for a reference on that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.