Workstation Trust Relationship Issue ~ Santhosh Sivarajan's Blog

Friday, May 14, 2010

Workstation Trust Relationship Issue

Friday, May 14, 2010 6:45 PM Blog-5 71 comments

Issue:

You receive the following error message, when you try to login to the domain.

The security database on the server does not have a computer account for this workstation trust relationship.

Solution/Workaround:

1.    Open ADSI Edit
2.    Go to Domain Partition
3.    Right click on the computer and go to Properties.
4.    Double click ServicePrincipalName and verify the SPN value for your Domain
5.    If SPN Value is missing, add a new SPN value in the following format.
        HOST/computername.domainname.com

6. Restart the computer.

Service Principal Name (SPN) - SPN consist of Service Class, Host, Port and Service Name in the following format:

<service class>/<host>:<port>/<service name>

The <service class> and <host> are required. But the <port> and <service name> are optional.

I have seen this issue on Vista, Windows 7, Windows 2008 and Windows 2008 R2 machines. As you might know Winlogon service on these Operating Systems use Kerberos logon. So the Service Principal Names (SPNs) need to be configured properly to support Kerberos Authentication.

However, if you are running Windows 7 or Windows Server 2008 R2, adding the computer to a Windows 2000 domain and running a program that calls the LookupAccountName function to retrieve a security identifier (SID) for an account, you may want to consider the following hotfix:

http://support.microsoft.com/kb/976494

71 comments:

Unknown says:

June 24, 2010 at 8:32 AM

Thank you, it was very helpful.

Blog-5 says:

July 8, 2010 at 12:29 PM

Thanks for the feedback..

Dan says:

January 24, 2011 at 11:31 AM

Hello,
I appreciate your post though this did not resolve my issues with the same "trust relationship.." issue. I see the host/machine_name.domain.local in ADSI edit and another 5 listings that seem to be correct.

I can easily rejoin the machine to the domain though I am trying to figure out why this keeps happening. It is happening more than I would like throughout our Windows 7 network. We deployed using Windows Deployment services and sysprep to create the images. This all goes fine and works. Though throughout the school year, we have machines here and there (not all machines...just a few) that are obviously loosing their connection with AD.

What is confusing is that a machine I am working on now was joined to the domain this past August 2010 and I am just now getting this issue on this machine. Do you have any ideas you could share with me of how to approach this. We are not having replication issues in our AD structure. It seems that the computer password is not changing somehow as I believe it expires after a certain time period. THen the secure channel is broken between it and AD not allowing users to login to the machine.
ANy help would be appreciated.
Thanks,
DC

Blog-5 says:

May 31, 2011 at 11:35 AM

Do you see any name resolution issues between workstation and DC? Did you verify the SPN?

Tom says:

July 12, 2011 at 2:40 PM

thanks Santhosh, this was very helpful in troubleshooting quickprep provisioned linked clone desktops with view 4.6. It seems the computer accounts were created without the correct ServicePrincipalName

Blog-5 says:

July 12, 2011 at 2:43 PM

Thanks for the feedback. You will see this issue if you “cloning” the computer accounts.

Venkat says:

August 10, 2011 at 1:02 PM

Hi,

I am glad to find this site !

While login in to the client machine (Win7) we are facing the same issue like "The trust relationship failed"
we used to fix this by unjoining the machince from domain and rejoin it. Is there any way to fix this issue without do this stuff.

your answer will must helpful for us.

thanks,
Venkat.

Blog-5 says:

August 10, 2011 at 1:06 PM

Hi Venkat,

Did you try the options described in this blog?

Did you verify the SPN?

lawtonterri says:

January 29, 2012 at 9:59 AM

Great post. Here’s a tutorial that shows how you can easily build an online database-driven web application with a parent-child table relationship, without codinghttp://blog.caspio.com/web-database/creating-one-to-many-relational-datapages/

Blog-5 says:

March 28, 2012 at 11:25 AM

Unknown says:

April 4, 2013 at 7:50 AM

Огромное спасибо!

Mariam says:

September 2, 2013 at 7:03 PM

This comment has been removed by a blog administrator.

Unknown says:

October 25, 2013 at 5:24 AM

This worked spot on for me! Never even came across ADSI editor before. Thanks a bunch

Blog-5 says:

October 25, 2013 at 10:19 AM

Thanks for the comment!

Param Ramanan says:

May 19, 2014 at 12:32 AM

Thanks santosh.
That was very helpful
Cheers

Unknown says:

September 17, 2014 at 2:46 PM

I have this problem over a year and I have not find a permanent solution yet. Run Asdi edit on workstation only? or server only or both? Your help is greatly appreciated.

Zemkarlos says:

May 19, 2015 at 3:01 AM

This comment has been removed by a blog administrator.

Anonymous comment! says:

July 20, 2016 at 1:08 PM

This comment has been removed by a blog administrator.

Anonymous comment! says:

July 20, 2016 at 1:09 PM

This comment has been removed by a blog administrator.

Unknown says:

May 17, 2017 at 2:25 PM

Thanks Santosh.....this helped me a great deal. Is there an explanation on why exactly this happens? For us this happened for a computer that was migrated from a different forest.

Choi Minzi says:

September 15, 2017 at 8:54 AM

Thanks for the feedback. You will see this issue if you “cloning” the computer accounts.

- - - Choi Minzi - - -
look what you made me do lyrics

Unknown says:

April 24, 2018 at 3:26 AM

Hi Venkat, We are facing this issue in our organization for the workstations which have Win7 installed. General solution is to Disjoin, join doamin by using localadmin account. But we are trying to find permanent solution for this problem. I read somewhere, Permanent solution is to upgrade it to Win10. (Note: we are not getting trust relationship issue for the Win10 workstations). I don't think there is issue with SPN in our case. As all the machines are sysprepped after cloning. Any suggestions are welcome! Thanks

Unknown says:

April 24, 2018 at 3:27 AM

Have asked this question to Santosh but any suggestion from anyone is welcome

Unknown says:

May 5, 2018 at 4:03 AM

Hi to all, how is all, I think every one is getting more from this site, and your views are good in favor of new viewers. netflix account

Unknown says:

July 26, 2018 at 11:44 AM

in my case the computer account was disabled, just enable it and the problem was solved.

Danny R. says:

May 13, 2019 at 2:05 PM

Thank you!!! Solved my issue!!!

Monnika Jacob says:

July 6, 2020 at 11:22 PM

Thank you so much Edward, but it needs the administrator password and unfortunately I've forgotten my administrator password. Is there any way we can do this without using administrator password? PhD dissertation writing services

Sarila tvala says:

August 11, 2020 at 10:17 AM

Thanks for sharing such an Amazing information, I Couldn't leave without reading your blog. I have read another good blog, I think you have read it too. click here Epson Printer klantendienst

Unknown says:

August 14, 2020 at 12:43 AM

The last time Ive commented here was back when I was doing a case study and this blog isn't even known yet. Now I actually have to wait for a comment confirmation. Heh, now that's what I call growth. games for mobile

Len Meyer says:

October 8, 2020 at 2:25 AM

it is really a great and helpful piece of info. I am glad that you shared this helpful information with us. Please keep us informed like this. Thank you for sharing Google belgium

Unknown says:

October 30, 2020 at 4:39 AM

Hi.. I read your blog which is really great and I must say that is amazing information. Keep posting. Must visit on mcafee suomi tuki

Ayana Tahiri says:

November 17, 2020 at 10:40 AM

Thanks for sharing such an Amazing information, I Couldn't leave without reading your blog. I have read another good blog, I think you have read it too. click here Avast telefoonnummer

mary Brown says:

December 1, 2020 at 10:10 PM

The effectiveness of IEEE Project Domains depends very much on the situation in which they are applied. In order to further improve IEEE Final Year

Project Domains practices we need to explicitly describe and utilise our knowledge about software domains of software engineering Final Year Project

Domains for CSE technologies. This paper suggests a modelling formalism for supporting systematic reuse of software engineering technologies

during planning of software projects and improvement programmes in Final Year Projects for CSE.

Software management seeks for decision support to identify technologies like JavaScript that meet best the goals and characteristics of a software

project or improvement programme. JavaScript Training in

Chennai Accessible experiences and repositories that effectively guide that technology selection are still lacking.

Aim of technology domain analysis is to describe the class of context situations (e.g., kinds of JavaScript software projects) in which a software

engineering technology JavaScript Training in Chennai can be applied successfully

The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing,

and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

Jianquan says:

March 9, 2021 at 8:32 PM

For your information, this custom gift packaging boxes manufacturer offers gift packaging box and custom-size plastic boxes packaging design OEM custom plastic parts and custom packaging boxes wholesale... Don’t hesitate to contact innovative plastic boxes supplier to order custom watch / candy plastic boxes right now! And we also Supply cardboard gift boxes wholesale

admin says:

June 14, 2021 at 4:51 AM

google 1551
google 1552
google 1553
google 1554
google 1555
google 1556

mikejasonuk says:

June 17, 2021 at 5:02 AM

In the event that you are a user of Brother printer at your home or workspace and looking for the right direction to interface it to Wifi then today you have arrived at the opportune spot. Connect brother printer mfc l2750Dw to wifi We, Tech Support Expert is the best outsider specialized network that is master in tackling all your printer issues. Our network has a group of multi-gifted and talented specialized experts who give lasting setup and extraordinary exhortation users. In this blog area, we are here with the answer for brother Printer not Connecting to WiFi issue

custom box manufacturer says:

June 18, 2021 at 11:04 AM

I appreciate your post thanks for sharing the information.
affordable Muffin boxes
Custom Metalized boxes

Tarun Choudhary says:

August 1, 2021 at 7:25 AM

Thanks for sharing

Qazi Anas says:

August 2, 2021 at 7:27 AM

This is a good post. This post gives truly quality information. I’m definitely going to look into it. Really very useful tips are provided here. Thank you so much. Keep up the good works hampshire seo services

Santhosh Sivarajan's Blog

Friday, May 14, 2010

Workstation Trust Relationship Issue

71 comments:

Post a Comment

Popular Posts

Share

Email Subscription