Domain Controller – What Causes a Workstation to Lose Trust with the Domain Controller?

active-directorydomain-controllerworkstation-management

I've received the error several times on Windows 7 Workstations and Laptops where it loses trust with the domain controller, and I know how to fix it, but why does it do that?

Best Answer

You probably already know this, but bear with me.

Computers have passwords in AD, just like users. We don't know our computer's password, and it changes regularly via built-in logic.

The short answer is that the computer's password is no longer valid, and therefore AD doesn't trust this machine for logins any more.

Why? How? Lots of things cause this. Something interfered with the password change process, or caused the machine to revert to an old password. Possible culprits include:

Restoring from backup.
Being powered off long enough for the password to expire, followed by network issues.
General intermittent network issues with poor timing.
Viruses, malware, etc.
More things that aren't occurring to me at the moment, probably.

I hope that helps.

Related Solutions

How to correct an “the security database on the server does not have a computer account” on a domain controller

Sounds like something's seriously messed up with that DC - if possible, consider just rebuilding it.

Also check for the same basics that you'd check for another system with this issue - that it has working name resolution, that its name matches its computer account in the domain, and that it and the other domain controllers have correct time. And dcdiag is always worth a look.

Anyway, what you'd want to try for rebuilding the trust with the domain will be the procedure outlined here - stop the KDC service then run a netdom resetpwd against the DC to rebuild its computer account.

DNS – Optimal Order of DNS Servers for an AD Domain Controller

According to this link and the Windows Server 2008 R2 Best Practices Analyzer, the loopback address should be in the list, but never as the primary DNS server. In certain situations like a topology change, this could break replication and cause a server to be "on an island" as far as replication is concerned.

Say that you have two servers: DC01 (10.1.1.1) and DC02 (10.1.1.2) that are both domain controllers in the same domain and both hold copies of the ADI zones for that domain. They should be configured as follows:

DC01
Primary DNS   10.1.1.2
Secondary DNS 127.0.0.1

DC02
Primary DNS   10.1.1.1
Secondary DNS 127.0.0.1

Best Answer

Related Solutions

How to correct an “the security database on the server does not have a computer account” on a domain controller

DNS – Optimal Order of DNS Servers for an AD Domain Controller

Related Topic