How do you fix a trust relationship between workstation and domain?

CTX227147

Article | Configuration 3rd party / compatibility | {{likeCount}} found this helpful | Created: {{articleFormattedCreatedDate}} | Modified: {{articleFormattedModifiedDate}}

Symptoms or Error

Users cannot log on to a system using Active Directory credentials and the following error message appears:
"The trust relationship between this workstation and the primary domain failed.”

 This issue is seen when the session logon is attempted through Remote Desktop Protocol, ICA, or directly at the console. Only logons using local accounts are successful. The underlying problem when this error is seen is that the machine you are trying to access can no longer communicate securely with the Active Directory domain to which it is joined.

Solution

First, determine which component is having the issue. Then use the repair method that works best for your environment.

  Provisioning Services Server, XenDesktop or XenApp Delivery Controller or XD/XA VDA: [Warning ! Never use Option 1 to reset machine account password for a PVS Target Device. See "Provisioning Services Target Device" under Option 4.]

Option 1: Reset the Computer Account Password in AD Users and Computers

Option 2: Reset via PowerShell

Option 3: Change the domain value in the System properties of the machine from the FQDN to the NETBIOS name [or vice-versa].[NOTE: Not applicable to delivery controller as per //support.citrix.com/article/CTX215880 ]

i] Login as a local administrator.
ii] Open the Windows System properties
iii] Change: “domain.net” to just “domain”

Option 4: CMD line using NETDOM tool:

1. Logon to the machine with a local administrator account.

2. Obtain the tool netdom.exe from Windows Server 2008 or Windows Server 2008 R2 CD to enable the Active Directory Domain Services role.

3. Note: For Windows Vista and Windows 7, utilize the Remote Server Administration Tools [RSAT] to enable the Active Directory Domain Services role.

4. Run netdom.exe to change the password.

5. Open command prompt with administrator rights.

6. Execute the command: netdom.exe resetpwd /s: /ud: /pd:*

7. Restart the machine
  
Provisioning Services Target Device

The brokern Domain Trust Relationship usually occurs in PVS due to the database containing an old password. This will happen if you initiate a password reset directly from Active Directory or the Target Device. Only resolve this using the PVS Console.

Make sure that you have configured the PVS environment properly.
Reference the following article: //support.citrix.com/article/CTX132289
Once that is confirmed. Shut the target device down and reset the machine account password for the affected target device in the PVS console.

Problem Cause

This can happen for a number of reasons. This article address the situations where the machine account password needs to be reset. These are the non-destructive methods for fixing the most common causes for the trust relationship issue.

  For example:

• Machine was disjoined and rejoined to the domain in PVS/MCS environment which discard all changes on reboot.
• Machine was restored to a system restore point or to a snapshot that is old enough to have a different machine account password than the one currently in use by AD.
• More than one machine on a network with the same hostname.
• AD Machine account object corruption.
• AD policy that would disable a computer after x number of days of not authenticating.
• Computer object in AD is deleted. 

Additional Resources

Disclaimer

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.