If a domain-joined Windows computer shows “The trust relationship between this workstation and the primary domain failed”, the secure channel between the computer and the Active Directory domain may be broken. Instead of removing the computer from the domain and joining it again right away, I first verify the state of the secure channel. It is the more controlled approach.
The problem
The user cannot sign in with a domain account, or gets the computer-to-domain trust relationship error.
1. Check DNS and Domain Controller access
ipconfig /all
nltest /dsgetdc:contoso.comcontoso.com is only an example; use your own AD domain name. Confirm that the client uses the correct AD DNS servers and can find a Domain Controller.
2. Test the secure channel with PowerShell
Test-ComputerSecureChannel -VerboseThis cmdlet is meant for domain-member workstations and member servers. Do not use it to repair the secure channel on a Domain Controller.
True means the secure channel works; False means a problem was found.
3. Repair the secure channel
First confirm DNS and DC access and that you have local administrator access. Then, in an elevated PowerShell session, run a controlled repair with an account that has the required domain permissions:
$Cred = Get-Credential
Test-ComputerSecureChannel -Repair -Credential $Cred -VerboseRun the test again afterwards.
4. Alternative checks
nltest /sc_verify:contoso.comIf there is a problem with DNS, time synchronization or DC access, repairing the secure channel alone may not be enough. Fix the underlying infrastructure cause first.
5. When do you need to rejoin the domain?
If the secure channel cannot be repaired in a controlled way and you have verified the state of the computer account, removing the computer from the domain and joining it again can be one of the last options. Make sure you have local administrator access before you do it.
Validation
Test-ComputerSecureChannel -Verbose
nltest /sc_verify:contoso.comThen test signing in with a domain user and Group Policy processing.
Additional checks
Check whether the computer account in AD is disabled, deleted or was recreated, whether replication between DCs is consistent, and whether time is synchronized. If the repair fails, save the error output and do not repeat the operation at random.
Conclusion
With a trust relationship error, removing the computer from the domain should not be the first reflex. Verify DNS and DC access, test the secure channel, and repair it with PowerShell if needed.