trust relationship

[Garacesh]

Could do it as a startup script, leave it in for a while, then take it out. But that's a bit kludgey.

 

IF NOT EXIST "C:\BCDEDITFlag.txt" (
BCDEDIT /set {default} recoveryenabled No
BCDEDIT /set {default} bootstatuspolicy ignoreallfailures
ECHO Startup Repair disabled > C:\BCDEDITFlag.txt
)

[Ed_Pinkman_13]

batch file as a startup (not logn) script

 

if exist c:\suroff.txt goto end
bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures
copy \\server\share$\suroff.txt c:\suroff.txt

:end

 

I need to try this now!!!

[IAMCloud_Curt]

We experience this all the time. Personally I think it's nothing to do with start-up repair. The way to solve it is simple.

 

Just follow this link below, I have uploaded a short guide (PDF) format.

 

https://drive.google.com/file/d/0B9n5idAVSIeNQi1BYV9DeHpTaWs/

 

Any problems, just @ me.

[Garacesh]

We experience this all the time. Personally I think it's nothing to do with start-up repair. The way to solve it is simple.

"The trust relationship between this workstation and primary domain failed."

 

I know it's a matter of re-connecting to the domain.

OP mentioned rejoining the domain - thing is prevention beats a cure.

It certainly seems to be caused by Startup Repair. Since we started disabling startup repair as per our imaging process, this has occurred less and less.

[witch]

I disabled Startup Repair in both my schools and I get very few trust relationship issues anymore. It is definitely related to the netbooks not being shut down properly - at the junior school the teachers stand over the children till the netbook has shut down but at the middle school the children take the netbooks back to the trolley, often in another block, by themselves and I reckon they just shut them in order to get away quickly. @CBlunt I think you might find that people have already said taking things off the domain and putting them back on again solves it.

[sted]

I disabled Startup Repair in both my schools and I get very few trust relationship issues anymore. It is definitely related to the netbooks not being shut down properly - at the junior school the teachers stand over the children till the netbook has shut down but at the middle school the children take the netbooks back to the trolley, often in another block, by themselves and I reckon they just shut them in order to get away quickly. @CBlunt I think you might find that people have already said taking things off the domain and putting them back on again solves it.

 

even simpler than that just remove the word .local (assuming your domain is school.local) from the domain in the same place and rejoin it in 1 reboot

[chekmate1984]

Hi all

 

I am getting this issue lot recently

 

i have run the cmd script with as shown in post 2 and i am still getting trust relationship issues!

 

any ideas what else i can do?

[Garacesh]

Is System Restore disabled?

This whole thing comes about because Startup Repair (which the bcdedit script disables) seems to perform - in some manner - a system restore or rollback (which in turn causes the trust relationship issue)

[chekmate1984]

i have gon through all machines and run a bat script in which below is present

 

bcdedit /set {default} recoveryenabled No

bcdedit /set {default} bootstatuspolicy ignoreallfailures

 

i will need to look at the affected machines to see if it has disabled it or not but as far as i know it did

[Garacesh]

More accurately, the BCDEdit script doesn't disable Startup Repair.

 

What it does do, is stops the 'Launch Startup Repair or Start Windows Normally' screen you're prompted with when booting after an incorrect shutdown (such as holding down the power button, as our kids are so prone to doing) so the laptop can't accidentally boot into Startup Repair (by idling for 30s) or by having that option selected.

 

The underlying issue won't actually be solved if the machine has already 'lost' its trust relationship. You'll need to drop it off and re-join it to the domain to fix that (or just delete the .local if your domain contains it) and it shouldn't happen again if you've already ran the BCDEdit script.

[J_Worth]

i have gon through all machines and run a bat script in which below is present

 

bcdedit /set {default} recoveryenabled No

bcdedit /set {default} bootstatuspolicy ignoreallfailures

 

i will need to look at the affected machines to see if it has disabled it or not but as far as i know it did

 

We've just done the same for all our Student machines. Time will tell I guess, but from all the comments about doing this, it's likely it will solve this issue for us.

[Duke5A]

I disabled Startup Repair in both my schools and I get very few trust relationship issues anymore. It is definitely related to the netbooks not being shut down properly - at the junior school the teachers stand over the children till the netbook has shut down but at the middle school the children take the netbooks back to the trolley, often in another block, by themselves and I reckon they just shut them in order to get away quickly. @CBlunt I think you might find that people have already said taking things off the domain and putting them back on again solves it.

 

@witch: You ever try setting a power profile through GPO and have it so the netbooks shutdown when the lid is closed? I had the exact same issue of students leaving these things on and stuffing them back into the carts. Since students can't lock the machine it would never go to sleep either. Staff seem to like it since it makes cleanup that much faster.

[rpettit]

batch file as a startup (not logn) script

 

if exist c:\suroff.txt goto end
bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures
copy \\server\share$\suroff.txt c:\suroff.txt

:end

 

Can I assume that the surfoff.txt doesn't need to contain anything?

 

Will the following just work?

 

bcdedit /set {default} recoveryenabled No

bcdedit /set {default} bootstatuspolicy ignoreallfailures

 

Regards

 

Rob

[Garacesh]

Yes, @rpettit

'if exist' is rather literal. It doesn't care about file size, content, MD5, or anything else. All it cares about is location and name.

If C:\ contains a file called suroff.txt, the condition is met.

 

(pet hate, and not sure if I mentioned this previously @sted, but instead of 'goto end' and then having :end at the bottom, 'goto eof' immediately ends the script)

[sted]

Yes, @rpettit

'if exist' is rather literal. It doesn't care about file size, content, MD5, or anything else. All it cares about is location and name.

If C:\ contains a file called suroff.txt, the condition is met.

 

(pet hate, and not sure if I mentioned this previously @sted, but instead of 'goto end' and then having :end at the bottom, 'goto eof' immediately ends the script)

 

fair enough it works and on some of my scripts i put common stuff after :end so eof dosent work in those cases so to keep my script consistent i just shove :end at the end

[Garacesh]

Makes sense. 'goto eof' is an immediate termination, so sometimes it isn't appropriate.

[shady_ry]

The ignore real failures bit worries me a little?

[Garacesh]

I'm honestly not sure what else IgnoreAllFailures will ignore, as the only thing I've encountered that launches Startup Repair is an improper shutdown (be that via the power button or a BSOD)

BSOD's usually get reported to us and we investigate/fix/replace bits as necessary, so it hasn't caused issue for us so far as we can tell.

We now have this script rolled into our base image, so once it's imaged this (amongst other scrips like wireless deployment) run

[julyan1]

Login in as local Admin and run the "Join a Domain or Workgroup" wizard under System Properties/Network ID.

Has never failed to fix this issue and only take a minute.

[shady_ry]

Login in as local Admin and run the "Join a Domain or Workgroup" wizard under System Properties/Network ID.

Has never failed to fix this issue and only take a minute.

 

Im a technician in training and That's exactly what i do and it's the common protocol for the issue. Happens quite regularly though and often more than one machine in the class with the issue so an overall fix is much coveted

[Garacesh]

often more than one machine in the class

No, it only happens on one machine at a time in 99% of cases

Problem is, kids don't tell the teacher, or the teacher doesn't tell you. Suddenly "All my laptops don't work!" and you have to rejoin 12 out of 30 machines to the domain (only to find out that half the machines out of those 12 aren't even from that set, because teachers have just sent pupils to borrow from another room and not sent them back properly)

It's definitely a Layer 8 issue, but this is the best we can do.

[Duke5A]

Why not just disable System Restore through GPO since that is the underlying problem? I have it disabled in my base image and have since XP. If a machine comes to the point that it needs a restore I just reimage.