Fix Trust Relationship

Sometimes it happens that your machine looses the trust with your primary domain.

In that case there are different option you try to fix it but you need AD Admin rights.

First one is simply disconnect the machine from the domain and rejoin it but pay attention that you need a password for a local admin account!

You could now simply go to System → Domain or Workgroup → Change and move it to a temp workgroup, reboot and than join it to the domain or you can use PowerShell for this.

$computer = Get-WmiObject Win32_ComputerSystem
$computer.UnjoinDomainOrWorkGroup("AdminPW", "AdminAccount", 0)
$computer.JoinDomainOrWorkGroup("Domain", "AdminPW", "AdminAccount", $null, 3)
Restart-Computer -Force

Another option is if the machine still exists in the AD to reset the machine password.

For this you can use this PowerShell Command here

Reset-ComputerMachinePassword -Server DomainServer -Credential DomainName\Administrator

or with

Test-ComputerSecureChannel -Verbose -Repair -Credential DomainName\Administrator

You can also use this command to simply check the current status

Test-ComputerSecureChannel -verbose

This would lead into a message like

VERBOSE: Performing the operation "Test-ComputerSecureChannel" on target "YourMachinName".
True
VERBOSE: The secure channel between the local computer and the domain YourDomainName is in good condition.

Another option is to use netdom but in a multi Server environment this could lead into issues as you don't know on what DC the machine does its authentifcation.

netdom resetpwd /Server:DC1 /UserD:administrator /passwordD:<em>password</em>

Also within the RSAT you could search for the machine, right click it and choose to reset the account.

But till now I never was successful with this one but as it is reported on some sites - maybe it's due to our special environment that it doesn't work.

And another option is also again a remove and add computer one

Remove-Computer -UnJoinDomaincredential DomainName\administrator -PassThru -Verbose -Restart

Add-Computer -DomainName DomainName -Passthru -Verbose -Restart

That are to most common ways - at least those I know