Trust Issues on Windows 7 Workstations

[AceDaz]

Hi

 

I am recently getting a few unable to logon becuase of trust issues on Windows 7 machines, re-joining them to the domain works ok.

 

Running DCDiag on our 2 DCs shows:

 

Starting test: NCSecDesc

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=ForestDnsZones,DC=DOMAIN,DC=LOCAL

 

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=DomainDnsZones,DC=DOMAIN,DC=LOCAL

 

Is this related, or is it something wrong with the image? The image was SYSPREP'd before deploying.

 

Thanks in advance

[Cache]

Don't think that's part of the problem, it seems to mean you haven't extended the AD schema for Read Only DC's: Dcdiag fails for NCSecDesc test on Windows 2008 Domain Controllers

 

I occaisionally get the odd Windows Thin PC dropping off the network with trust issues, I normally put it down to the way I butchered the shell to simplify login. I do occaisionally think about it, but then take a look at the PC's I normally have to rejoin and it's always the same few, some have been running for over a year and a half without issue, others it's every 90 days or so.

[AceDaz]

Thanks, It has been running for nearly 2 years with no issues but these appear to be recent within the last few weeks.

[sted]

does the workstation refuse to logon with

 

The trust relationship between this workstation and the primary domain failed

 

if so disabling startup repair will probably cure or at worst severly reduce its chance of happening

 

this as a startup script is what i use

 

VER | findstr /l "6.1" > nul

IF %ERRORLEVEL% EQU 0 goto _win7

goto end

:_win7

if exist c:\startuprepairoff.txt goto end

bcdedit /set {default} bootstatuspolicy ignoreallfailures

copy "\\domain.local\NETLOGON\win7\disablestartuprepair.bat" "c:\startuprepairoff.txt" /y

 

:end

Edited January 17, 2014 by sted

[AceDaz]

does the workstation refuse to logon with

 

The trust relationship between this workstation and the primary domain failed

 

if so disabling startup repair will probably cure or at worst severly reduce its chance of happening

 

this as a startup script is what i use

 

VER | findstr /l "6.1" > nul

IF %ERRORLEVEL% EQU 0 goto _win7

goto end

:_win7

if exist c:\startuprepairoff.txt goto end

bcdedit /set {default} bootstatuspolicy ignoreallfailures

copy "\\domain.local\NETLOGON\win7\disablestartuprepair.bat" "c:\startuprepairoff.txt" /y

 

:end

 

 

Thanks

 

Can you explain what it does exactly and what is in the \\domain.local\NETLOGON\win7\disablestartuprepair .bat batch file (and you know you have a space between repair and .bat)

[sted]

Thanks

 

Can you explain what it does exactly and what is in the \\domain.local\NETLOGON\win7\disablestartuprepair .bat batch file (and you know you have a space between repair and .bat)

the disablestartuprepair.bat is what ive called the batch file i copy it to the local machine as an error check.

 

what ot does os stops startup repair running because the pc wants to. it can still be run manually but wont autorun if the pc isnt shutdown right

[AceDaz]

the disablestartuprepair.bat is what ive called the batch file i copy it to the local machine as an error check.

 

what ot does os stops startup repair running because the pc wants to. it can still be run manually but wont autorun if the pc isnt shutdown right

 

Thanks

[JonDaviesBourne]

"Test-ComputerSecureChannel -Repair" in Powershell when logged on as a local administrator sorts out most trust issues

[Michael]

In my experience wireless clients suffer from this problem more than wired clients. Here's a simple solution to resolving this issue