Error on Windows Server or Client Machine "Trust Relationship Between Workstation and Primary Domain Failed"

A Windows machine that is a member of an Active Directory domain displays the below error when a user attempts to log in to the domain. The user is then returned to the login prompt, so no domain login is possible.

The trust relationship between this workstation and the primary domain failed.

This error occurs when the secure channel between the affected machine and Active Directory is broken. The secure channel is the mechanism by which domain-joined machines communicate securely with domain controllers, and it relies upon the password associated with a computer account.

Every domain-joined computer has an account in Active Directory, and every computer account has a password associated with it. These computer account passwords are separate from user account passwords and are managed, synchronized, and updated automatically with no need for user interaction. In some situations, however, the computer's own copy of its password becomes unsynchronized with the copy that is stored in Active Directory. When this happens, the secure channel cannot be established, and the above error is displayed when a user attempts to log in to the domain.

The quickest way to resolve this issue is to remove the affected machine from the domain by adding it to a workgroup, then readd it to the domain. This can be accomplished with the following steps:

   

1. Log in to a local administrative account on the affected machine.
2. Launch the System Properties window. Depending on the version of Windows running on the machine, there are multiple ways to accomplish this.
   • In Windows Server, launch Server Manager, click Local Server in the left pane, and click the name of the domain in the main pane.
   • On a Windows client, click the Start icon and begin typing advanced system settings. Select View advanced system settings when the option appears.
3. In the Computer Name tab, click the Change button.
4. Select Workgroup and type the name of a workgroup. The specific name does not matter, as this is a temporary workgroup. Click OK.
5. Click OK to acknowledge the dialog boxes that appear.
6. Click Close to close the System Properties window. Reboot the computer when you can do so.
7. At the login prompt, log in to the same local administrative account as before.
8. Launch the System Properties window.
9. In the Computer Name tab, click the Change button.
10. Select Domain and type the name of the Active Directory domain. Click OK.
11. Supply the credentials of a domain user account that has permission to add the computer to the domain. Click OK.
12. Click OK to acknowledge the dialog boxes that appear.
13. Click Close to close the System Properties window. Reboot the computer when you can do so.
14. At the login prompt, confirm that you can now log in to a domain account without receiving an error.