"The trust relationship between this workstation and the primary domain failed."

[ronanian]

I have VMWare ESXi 3.5 and 5.0 vSpheres. When I deploy a template or clone a VM running Windows I expect to see "The trust relationship between this workstation and the primary domain failed." unless I sysprep (and sometimes even then). The cure is to remove from the domain and re-join. Ok, no problem, I do that on the newly deployed VM.

 

I have one Windows Server 2008R2 terminal server template that does something worse. When I deploy it, all existing live VMs based on that template get "The trust relationship between this workstation and the primary domain failed." What am I doing wrong?

 

I have to deploy it again and I'm not looking forward to re-joining all of its siblings again.

[ronanian]

Bump. Probably nobody knows exactly, but any unsure guesses at least?

[sted]

i assume the clones are already domained but pc passwords reset over time so if you apply changes in bulk to vms theres a fair chance the pcs password will get reset. it is possible via group policy to stop computer account passwords changing but its contra indicated and only works going forwards (so next time you bulk apply updates it would roll back to a previous password anyway.

 

try running the following in powershell

 

Test-ComputerSecureChannel -repair shouldnt even require a reboot

[Netman]

I'd say it's probably best practice to remove them from the domain and sysprep before creating the template - then join the domain as you create the new VM's? You're always gonna get security issues with duplicate SIDs and names on Windows domains...

[Michael]

I'm not sure why you're getting this problem, but it does happen often with wireless clients. Here's a fix which works 100% to stop trust type errors -

 

Hive: HKEY_LOCAL_MACHINE
Key Path: SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Value Name: DisablePasswordChange

Value type: REG_DWORD
Value data: 00000001

 

See pic for example:

 

[FishCustard]

What does the above fix do, prevent people from changing their passwords on those particular machines? (which would be no big deal in order to prevent issues!).

[plexer]

No it prevents the machines themselves changing their computer account password.

 

Ben

[FishCustard]

Ahhh, yeah, that makes sense.

[ronanian]

Success! I figured out how to avoid the problem. All I have to do is NOT be an impatient jerk.

 

Normally when Windows says I need to restart I say "You're not the boss of me, I'm in charge! http://allofftopic.com/images/smilies/gorilla_1.gif".

 

This time I disconnected the (virtual) network cables, started Windows on the newly deployed VM, removed it from the domain, and when it asked to restart I actually allowed it to...then once it was restarted I assigned an IP, reconnected the (virtual) network cables, joined it to the domain, and when it asked to restart once again I immediately allowed it to do so.

[adrian_costea]

I will be better to just create the VM template in a workgroup environment and syspreped. That way when you deploy a VM from that template you only have to add the VM to the domain and you're done. No more disconnected adapters and remove server from the domain.