Domain Trust Issues

[talksr]

I work for a number of schools who have the same server 2012 set up as a FRDC with DHCP, DNS, Active Directory and Group Policy all running from the sole server.

 

One school in particular always seems to have domain trust problems on client computers.

On a weekly basis, we have between one and four systems which drop off of the network and display "The trust relationship between this workstation and the primary domain failed". The only way to resolve this issues, is to remove the system from the domain, and rejoin it.

 

At first, we thought that the users were putting systems on standby repeatedly which could have caused the problem. I prevented this by disabling standby via GPO, however the problem still remains.

 

Both client machines and server have firewall disabled and use Ranger 8.

I have suspicions that there could be problems on the network in general.

 

Can anyone recommend any steps I can take to try and prevent this recursive problem?

[FN-GM]

Its caused by Start up repair. If you disable it the issue get resolved.

 

Use the following in a Batch file or command prompt.

 

bcdedit /set {default} recoveryenabled No

bcdedit /set {default} bootstatuspolicy ignoreallfailures

[talksr]

Its caused by Start up repair. If you disable it the issue get resolved.

 

Use the following in a Batch file or command prompt.

 

bcdedit /set {default} recoveryenabled No

bcdedit /set {default} bootstatuspolicy ignoreallfailures

 

Thanks very much, a very useful and worthwhile reply. Do I just literally cut and paste this into a bat and execute on each client machine?

[FN-GM]

Exactly that.

 

You may run into an issue if you have BitLocker enabled and the OS drive encrypted.

[talksr]

Exactly that.

 

You may run into an issue if you have BitLocker enabled and the OS drive encrypted.

 

Great, thanks so much, and no bitlocker so nice and easy for me. I will set it to run at logon via the netlogon batch which runs.

 

Thanks again for your help!

[FN-GM]

Great, thanks so much, and no bitlocker so nice and easy for me. I will set it to run at logon via the netlogon batch which runs.

 

Thanks again for your help!

 

Logon script might not work as its a machine change. Startup 100% works though.

[talksr]

Logon script might not work as its a machine change. Startup 100% works though.

 

Ok thanks. What did you mean by startup? Where would I need to put it for startup?

[FN-GM]

Ok thanks. What did you mean by startup? Where would I need to put it for startup?

 

On a computer group policy, under the computer section there is a scripts area. Both Startup and Shutdown. If you put it in either of those you should be fine. Works similar to user scripts.

[witch]

In my schools it is caused by users shutting the computer down by just holding down the power button.

[GuyJD]

I ran into this problem a lot in the past because machines were imaged using ghost but at no point was a sysprep run so all the machines were using the same GUID and this in turn made the server think someone had cloned a machine and was trying to get in on an unauthorised device.

[Michael]

This is a big issue on Windows 7 devices, but I use the exact same fix above.

 

Now the big question is, will Windows 10 suffer from the same problems I wonder? I'll have to experiment and deliberately power one off multiple times.

[sted]

In my schools it is caused by users shutting the computer down by just holding down the power button.

iirc its more to do with the repair tool running afterwards it rolls the pcs ad account password back to some point in time after it had been changed so the pcs version of the password and the dc version of the password no longer match

[swiftysw1]

Did this resolve the problem

[Guest Guest]

It does swifty

[swiftysw1]

Ok I have copied the lines into a batch file and when run I get an Access is denied error on each line..

 

The boot configuration data store could not be opened.

Access is denied.

 

Any ideas?

 

Thanks

Si

[Guest Guest]

You need to run the batch file as an Administrator