New laptops get Trust Relationship issue

[Theldron]

Hi all,

 

Happy Friday.

 

Don't know if anyone can help with this, we are getting a weird issue with some new laptops we have brought, we image them and set them up fine, but after a short time with the teacher, they get the "Trust Relationship Between This Workstation And The Primary Domain Failed" error. With a short time I mean hours not days.

 

I am getting the technician at the school to try a old laptop to see if the issue rears its head. All existing PCs and laptops seem fine though.

 

I did notice that DHCP had a lot of duplicate records (name and IP addresses) and DNS held stale records back to 2017. I have cleaned these up, so not sure if that was part of the cause.

 

Any ideas would be appreciated.

Thanks

[Olliedawg]

Duplicate object in AD with the same name? Are you positive all of the new laptops have unique names? I've messed up before & named two PC's i was imaging the same & this caused the first one to lose trust, which makes sense because the object was overwritten. Worth checking.

[Theldron]

@Olliedawg Hiya, thanks I have looked and can't find any duplicate names in AD.

[Olliedawg]

@Olliedawg Hiya, thanks I have looked and can't find any duplicate names in AD.

 

Well it wouldn't exactly be a duplicate in AD, as if this was the case, the new PC will overwrite the original object.

 

You could test two laptops & ensure the names are different, to rule that out.

 

I had a similar issue with some exam laptops before & was scratching my head at it for a good half hour, before I realised I had named two of them the same!

[Theldron]

Sorry of course haven't had enough coffee yet, see what you mean. Thanks mate.

[Theldron]

Is there a way to check for duplicate names with different SIDs or mac addresses, through powershell etc?

[Olliedawg]

Sorry of course haven't had enough coffee yet, see what you mean. Thanks mate.

Haha know the feeling

 

 

Is there a way to check for duplicate names with different SIDs or mac addresses, through PowerShell etc?

 

Hmm not sure.. hopefully someone else can assist with that one. Hopefully you're on the right track now though!

[PotNoodleTech]

Sounds a strange one - could be Windows update updating motherboard or network drivers causing an issue?

 

Might be worth imaging a laptop and keeping it on your desk in your room for a day to keep an eye on it and see what it does, does it stop working on its own, does it pick up windows updates and stop working, etc?

[howartp]

Would time-slip cause that error?

 

I know you can't logon if time is too far out, but not sure if that's the right sort of error you'd get?

[jthompson]

Perhaps check for any AD replication issues. IIRC the 'trust relationship' error is down the the machine password not lining up with what the DC is expecting from it. That wouldn't necessarily explain the error being seen only after imaging certain machines, though.

 

Does restarting an affected machine (ideally with an ethernet cable connected) clear the error?

[triggmiester]

Take off the domain and re-join. This is the only way I have found to solve this issue

[PotNoodleTech]

Thinking about it could it be an imaging/build issue?

 

We had our LEA build some PC for us (first time, and last time I ever asked them to).

 

They must have used some kind of cloning software to do the imaging (rather than say, building them individually on MDT)

 

This cloning sofdtware broke the AD links on every PC - and I had to do as people have suggested above, remove from the domain back to local work group, check AD and delete any objects, then re-add to domain from scratch.

[jthompson]

I've a feeling you can do it without having to re-join or reboot.

 

Reset-ComputerMachinePassword - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1

 

Also, this might to the trick, too:

 

Test-ComputerSecureChannel -Repair

 

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

Edited April 17, 2024 by jthompson

[Theldron]

Hi all,

Thanks for the help.

 

Looks like it was user error. Computers being imaged, updated, then turned off. Then new computer being imaged with same name.

[DavonPotter]

That trust relationship error is a pain. Cleaning up DHCP and DNS was a good move. Check if the new laptops' system time is synced with the domain controller, as time differences can cause trust issues. Also, ensure they’re properly joined to the domain.