Troubleshooting AD: Trust Relationship between Workstation and Primary Domain failed

Error message

Error “Trust Relationshitp between Workstation and Primary Domain failed”, is the most encountered message when you are dealing with Active directory domain services.

If the Secure Channel is Broken between Domain controller and workstations

When a Computer account is joined to the domain, Secure Channel password is stored with computer account in domain controller. By default this password will change every 30 days (This is an automatic process, no manual intervention is required). Upon starting the computer, Netlogon attempts to discover a DC for the domain in which its machine account exists. After locating the appropriate DC, the machine account password from the workstation is authenticated against the password on the DC.
If there are problems with system time, DNS configuration or other settings, secure channel’s password between Workstation and DCs may not synchronize with each other.

A common cause of broken secure channel [machine account password] is that the secure channel password held by the domain member does not match that held by the AD. Often, this is caused by performing a Windows System Restore (or reverting to previous backup or snapshot) on the member machine, causing an old (previous) machine account password to be presented to the AD.

Resolution

Most simple resolution would be unjoin/disjoin the computer from the domain and rejoin the computer account back to the domain.
(this is a somewhat similar principle to performing a password reset for a user account)

Or.

You can go ahead and reset the computer account using netdom.exe tool
netdom reset ‘machinename’ /domain:’domainname

 

Netdom

Commands


Command Description
Netdom add Adds a workstation or server account to the domain.
Netdom computername Manages the primary and alternate names for a computer. This command can safely rename Active Directory domain controllers as well as member servers.
Netdom join Joins a workstation or member server to a domain. The act of joining a computer to a domain creates an account for the computer on the domain, if it does not already exist.
Netdom move Moves a workstation or member server to a new domain. The act of moving a computer to a new domain creates an account for the computer on the domain, if it does not already exist.
Netdom query Queries the domain for information such as membership and trust.
Netdom remove Removes a workstation or server from the domain.
Netdom movent4bdc Renames a Windows NT 4.0 backup domain controller to reflect a domain name change. This can assist in Windows NT 4.0 domain renaming efforts.
Netdom renamecomputer Renames a domain computer and its corresponding domain account. Use this command to rename domain workstations and member servers only. To rename domain controllers, use the netdom computername command.
Netdom reset Resets the secure connection between a workstation and a domain controller.
Netdom resetpwd Resets the computer account password for a domain controller.
Netdom trust Establishes, verifies, or resets a trust relationship between domains.
Netdom verify Verifies the secure connection between a workstation and a domain controller.