0

I've been getting this message a lot lately:

The Security database on the server does not have a computer account for this workstation trust relationship

I'm building a few Windows VMs. The fix is to leave the domain and then rejoin it. It's a bit labor intensive though... is there any way to do this via script and not have to reboot in the middle? Doing it the manual way takes about 3-5 mins.

5
  • 1
    Actually the fix is to make them not change their computer account password and make it not expire. On my phone or I would look up the procedure for that.
    – Grant
    Jan 14, 2015 at 2:02
  • How are you building these VM's? Are you using a template VM of some sort?
    – joeqwerty
    Jan 14, 2015 at 2:05
  • Yes, typically cloning an existing VM, renaming the machine, leaving domain, rejoining domain. Even with that, I still get cryptic AD messages from time to time.
    – jcollum
    Jan 14, 2015 at 2:06
  • You should sysprep your clone/template. Then use it to deploy new virtual machines. You'll avoid this problem completely.
    – joeqwerty
    Jan 14, 2015 at 5:24
  • @joeqwerty Because of the new...ish sysyprep/rearm limits added to Windows OSes, it's often better to do a scripted sysprep of new machines after they're cloned, rather than having to worry about how many times your template/source VM has been sysprepped. Jan 14, 2015 at 7:55

1 Answer 1

5

No, you cannot avoid the reboot. You can script the joining and disjoining of a domain, but you're solving the wrong problem.

The proper approach is not to clone domain-joined VMs in the first place. Create a template of a VM that is in a workgroup, rather than a domain, then rename and domain-join it once it's finished cloning/deploying from a template.

And, as noted by Big Chris in the comments below, don't forget to sysprep, provided you want things like Windows Update and SCCM to work properly.

4
  • 1
    Even better would be to use any of the automated scripted deployment tools in your template and avoid "cloning" the vm in the first place
    – Jim B
    Jan 14, 2015 at 4:37
  • Don't forget to sysprep as well to remove SIDs... Or does this not matter with workgroup clones (that will eventually be domain joined)?
    – Kinnectus
    Jan 14, 2015 at 5:41
  • @BigChris Actually, SID duplication being a problem is a myth, but there are other really good reasons to use sysprep. I suppose I should mention that. Thanks! Jan 14, 2015 at 5:44
  • 1
    Great article. Just sat and read the lot ;) I think ANYONE doing image deploying should do sysprep regardless of whether it's actually necessary. At the end of the day, especially with Win 7/8, it is the easiest final step of the process and it'll let you (much more easily) standardise the image for multiple hardware profiles. Plus WIM's are blummin' useful too! Off on a tangent there but great article and very useful answer :)
    – Kinnectus
    Jan 14, 2015 at 7:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .