What is wrong:

I am trying to join a server to the domain. I was able to join it, restart the server, and when I tried to log in, I got the error:

Trust Relationship Between Workstation and Domain Fails

Working from this this article, I ran the following commands:

Test-computersecurechannel -verbose

Test-computersecurechannel -repair -verbose

and got the following output:

The secure channel between the local computer and the domain (domain name) is broken.

The attempt to repair the secure channel between the local computer and the domain (domain name) has failed.

What I've tried:

I tried rejoining to the domain. I tried reseting the computer account in AD and rejoining the domain. I tried recreating the computer account and rejoining to the domain.

How do I fix this? Is this a DC Replication issue?

I am running Windows 2012.


Just found this: the server time is off. CMOS clock is the time source (as a vm). Set CMOS, but this didn't fix the issue...

  • By resetting the computer account in AD what do you mean? What I would try is (and if you've already done this forgive me, but I wasn't clear on what you said on the last part of your question) unjoin the computer from the domain > delete the computer account from AD > force replication (AD Sites and Services) > then rejoin to the domain and force replication again. Let me know the results of this and we can troubleshoot further if needed. May 5 '14 at 15:57
  • When I said reset the computer account, I mean I looked it up in AD and right clicked the compuer object and clicked reset computer account. I have tried what you said, but I'll try it again in case I missed something.
    – Jeff
    May 5 '14 at 16:03
  • @BradBouchard tried what you suggested... No luck.
    – Jeff
    May 5 '14 at 16:11
  • Please do. Let me know the results then too. I have a meeting to go to but can help you in about 30-45 minutes if what I suggested doesn't fix it. May 5 '14 at 16:12
  • Two things: 1) Try doing my steps again, but when you join it to the domain give the computer a different name just as a test. 2) Try joining another new computer to the domain and see what the results are. May 5 '14 at 17:03

You need to reset the machine account password for the computer in question.

First, make sure the ports listed here are open on your network between the server and the Domain Controllers.

Then, run this command from an elevated Command Prompt (Right-click > Run As Administrator) on the client computer with trust issues:

Netdom reset %COMPUTERNAME% /UserO:domainAdminUser /PasswordO:* /SecurePasswordPrompt
  • The %COMPUTERNAME% environment variable should already be set by default, if not then replace it with your computer's short name.
  • The /UserO (that's a capital-"oh", not a zero) needs to be a member of the Domain Admins group.
  • The /PasswordO:* /SecurePasswordPrompt option will create a credential popup to get the password for domainAdminUser rather than typing your password directly into the command-line.

Follow the steps here if you get lost.

Also, make sure that there aren't issues with the SPN. See here for a reference on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.