I have a Windows Server 2012 domain controller on a domain DOM1 running at a Windows Server 2008 R2 domain and functional level. All other domain controllers in DOM1 are 2008 R2. DOM1 has a two-way non-transitive trust with another domain DOM2 running at a Windows Server 2003 forest and functional level.
There is one Windows 7 machine on DOM1 that is on the same LAN as the domain controller. When a user with an account in DOM2 attempts to log into this machine, they get the error:
The security database on the server does not have a computer account for this workstation trust relationship.
When I power off the 2012 domain controller, the error does not appear and the user can log in. When I turn the DC back on, the user gets the error.
Yesterday I turned the DC on, unjoined the Windows 7 machine from DOM1, then rejoined it. The user was then able to log in. Today, however, the user once again got the error. I turned the DC off and the user logged in.
I noticed that after rejoining the Windows 7 machine to the domain, the computer account shows up in AD as disabled.
A few other computers in the same location also get the error, however, most don't.
Here are my questions:
Why does the error occur only when the 2012 DC is on?
How is the user able to log into the Windows 7 machine even if the computer account is disabled?