I am having a problem with a recently reinstalled laptop with Win 7 Enterprise. The computer is complaining about a broken trust relationship when I try to grant domain users local access on the machine.

I've done the following (twice, using a different name each time) and it doesn't resolve the issue:

  1. As domain administrator, leave domain and join workgroup: WORKGROUP.
  2. Reboot.
  3. As domain administrator, join domain using new computer name.
  4. Reboot.
  5. As domain administrator, add a domain user as local administrator.
  6. Error: "The trust relationship between this workstation and the primary domain failed."

This doesn't make any sense to me. As I understand it the above process is the appropriate way to fix this issue.

So far, other symptoms I've experienced are:

The client machine says it's unable to reach the domain. Meanwhile, on the server, I see EventID 5723 from NETLOGON:

The session setup from the computer [name_of_computer] failed because there is no trust account in the security database for this computer. The name of the account referenced in the security database is [name_of_computer]$.

An inability to to ping hosts by hostname when joined to the domain. When off the domain, I can ping hosts just fine.

nslookup [fqdn] returns the proper value for both my domain controllers, and nsloookup [DC hostname] returns the proper IP for the domain controller as well.

I've checked to see that the DNS servers are being assigned properly to the clients, and they are.

I also don't believe I have any WINS servers handing out incorrect NS information. Neither Domain Controller has that role installed (though if anyone has a definitive way to check for WINS servers, that might be helpful).

Can anyone provide some further troubleshooting steps?

  • what do you see in the event logs on both the dc and the workstation.
    – tony roth
    Jul 18, 2012 at 0:07
  • 1
    possible duplicate of Windows 7 Trust issues
    – MDMarra
    Jul 18, 2012 at 0:26
  • @MDMarra I don't believe so. The accepted answer in that post does not apply here. (1) I am using computer names that didn't previously exist, (2) time is not out of sync, and (3) I have only one site and I am operating locally. Let me know if you think otherwise though because I just want to get this resolved. Jul 18, 2012 at 0:33
  • 2
    You asked for basic troubleshooting steps. They're the same steps. You can still have replication problems in a single site, I'd start there.
    – MDMarra
    Jul 18, 2012 at 0:58
  • 1
    This question is accumulating enough comments trying to diagnose what's going on that it's actually tripping automated alarms. That's a good sign that it's insufficiently detailed for us to help you figure out what to do, and needs a rewrite. Please consolidate all the relevant information gained thus far into the question, then let me know, and I will clear the comment history and re-open the question to give it another shot at getting a useful answer.
    – voretaq7
    Jul 18, 2012 at 20:02

4 Answers 4


Your next troubleshooting step is to examine the DC EventLogs for anything useful, and following that, you'll want to figure out why the computer can't "reach the domain."

You might want to reverse the order of those, and they might lead you to the same spot, but looking for errors in the EventLog is usually easier than troubleshooting your network, which is why I'd recommend starting there.

Incidentally, if the computer can't "reach the domain," how are you able to join it to the domain at all? Sounds to me like it's not properly joining to the domain, which is why the trust relationship is still broken. Haven't seen that before, honestly... but you could try changing its name when it's domain-joined to test that idea. See if the name changes in ADUC, or not (and see if it changes on all your DCs, or not - maybe there's a replication problem that's preventing the domain from recognizing the new computer account). While you're in there, you might want to check and make sure the various computer accounts you created when "rejoining" it actually show up in AD. I'm betting they didn't.

  • I left and rejoined the domain again using the latest computer name. That process went without a problem. Now being back on the domain I am no longer able to ping hosts. As you asked, how can I not ping hosts but I can authenticated against the DC to leave and rejoin the domain? I don't know but it's certainly not a physical disconnect in the network. The computer account appears in DNS and AD. I am unable to rename the computer because "network path not found" which is likely a result of the lack of connectivity in DNS. Lastly, both DCs have no errors for this computer (as of the last join). Jul 18, 2012 at 0:40
  • Sounds like you have a GPO setting the client DNS servers to the wrong value.
    – MDMarra
    Jul 18, 2012 at 0:59
  • @MDMarra I checked that early on but the DNS servers seen by ipconfig /all are correct. Jul 18, 2012 at 1:13
  • Yeah, that definitely sounds like a DNS error. Does nslookup return the correct value for your domain controller? (And the DC's hostname isn't longer than 15 characters, is it?) Jul 18, 2012 at 11:21
  • @HopelessN00b Yes, it does. I'm googling for this symptom but haven't found a resolution yet. It's definitely very strange. Jul 18, 2012 at 15:58

Since you can't even ping after joining the domain, the problem is somewhere in the networking stack and has nothing to do with the trust relationship per se. (This means the usual troubleshooting steps for trust relationship errors, such as rejoining the domain, don't apply.)

My bet is that the Windows Firewall domain settings are messed up. To confirm this, turn Windows Firewall off (briefly!) and see if that lets you ping. If it does, check the settings, or try using the "Restore Defaults" option in the Windows Firewall control panel.

  • Windows firewall won't have anything to do with this. Since most of these domain functions he's talking about use name resolution (NETBIOS or DNS), that's where he needs to look, and the usual troubleshooting step do apply... at least in a normalish AD environment. Jul 18, 2012 at 11:30
  • @HopelessN00b: I don't see how you can rule out a problem with Windows Firewall. He doesn't appear to have any network connectivity at all, and Windows Firewall could certainly do that if it was configured to block outgoing traffic. Jul 18, 2012 at 19:59

Have you checked the box that says "Change primary DNS suffix when the domain membership changes"?

  1. update the drivers on the local workstation NIC
  2. then delete the computer out of AD refresh
  3. then re add to the Domain...

If that doesn't work, check GPO next.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.