Fixing Active Directory Trust Relationship Issues: 6 Effective Methods

When a computer loses trust with the Active Directory (AD) domain, users may experience authentication issues, failed logins, or other network-related problems. This can happen due to multiple reasons, such as computer password mismatches, time synchronization errors, or network disruptions. Below are six proven methods to fix Active Directory trust relationship issues efficiently.

🔹Disjoin & Rejoin the Domain (dsjoin)

Sometimes, the best approach is to disjoin and rejoin the domain to reset the trust relationship.

1. Log in as a local administrator.

2. Open Command Prompt and run: dsjoin /leave

3. Restart the computer.

4. Rejoin the domain using: dsjoin /domain DomainName /userD DomainAdminUser /passwordD 

5. Restart the computer again to complete the process.

🔹 Repair Trust via PowerShell

Instead of rejoining, you can attempt to repair the trust using PowerShell.

1. Log in as a local administrator.

2. Open PowerShell and run:

   Test-ComputerSecureChannel -Repair -Credential DomainName\Administrator

3. Restart the computer.

🔹 Reset Computer Password Using PowerShell

If the computer account password is out of sync, resetting it may help.

1. Log in as a local administrator.

2. Open PowerShell and run:

   Reset-ComputerMachinePassword -Server DomainServer -Credential DomainName\Administrator

3. Restart the computer.

🔹  Reset Secure Channel Using Netdom

Another way to restore trust is by resetting the secure channel using Netdom.

1. Log in as a local administrator.

2. Open Command Prompt and run:

   netdom resetpwd /Server:DomainController /UserD:DomainAdmin /PasswordD:*

3. Restart the computer.

🔹 Delete & Recreate Computer Object in Active Directory

If none of the previous methods work, deleting and recreating the computer object in AD may be necessary.

1. Open Active Directory Users & Computers (ADUC) and delete the problematic computer account.

2. Log in as a local administrator.

3. Open PowerShell and unjoin the domain:

   Remove-Computer -UnjoinDomainCredential DomainName\Administrator -PassThru -Verbose

4. Restart the computer.

5. Rejoin the domain:

   Add-Computer -DomainName "DomainName" -Credential DomainName\Administrator -Restart

🔹 Check & Sync System Time

Time mismatches between the workstation and the domain controller can cause trust issues.

1. Log in as a local administrator.

2. Run: w32tm /resync

3. If needed, manually configure time synchronization:

   w32tm /config /manualpeerlist:"time.windows.com" /syncfromflags:manual /update

4. Restart the computer.