Widespread workstation trust relationship issues

active-directorywindows-server-2008

Problem: In the past 3 years I've run into the "The Trust Relationship between this workstation and the primary domain has failed" less than 3 times. Those cases were all laptops that hadn't been connected to the network for a long time. Now within the last 3 months I've had 6 incidents, 1 on a desktop always connected to the network and 1 on a virtual server of ours.

Usually the fix is unjoining and rejoining them to the domain. If this issue becomes more prevalent the fix is inconvenient at best and nearly impossible if you have to walk someone through it remotely who is not tech savvy. I'd like to get out in front of this issue if possible.

The cause, I've read, is when either of the machine account (on the computer) passwords (2 are stored) don't match up with the password stored for the machine account in AD. I can see this happening if the machine hasn't been on the network in a while, but this is happening to computers and servers that are plugged into the network 100% of the time or on wireless for very short periods of time.

I'm trying to diagnose if there's a problem with the way our machines and servers are talking to one another that's causing this error to pop up on machines that are always plugged into the network or plugged in frequently enough that passwords between machine and server shouldn't be that out of sync.

Background: Mixed 2003 and 2008 R2 servers, Mixed XP and Windows 7 machines. 3 physical locations split out into seperate OUs.

Research: New machines are not cloned from one image that could cause "same name" conflicts on the network. This is not specific to one OU or another. This is not specific to one OS or another.

I've dipped into system event logs and turned on netlogon debugging with no specific items jump out on my but my Windows Server Log knowledge is fairly limited.

Any help is appreciated.

Best Answer

Have you looked at the File Replication Service/ DFSR logs to see if there are errors there? I have seen instances where corruptions/errors in the USNJournal will cause these types of problems.