“The trust relationship between this workstation and the primary domain failed”: how to fix it

Applies to: domain-joined Windows 11, Windows 10 and Windows Server computers. You need a domain account with permission to reset or join computers, so on a work PC this is usually a job for IT.

What the error means

Every computer joined to an Active Directory domain has its own account and password in the domain, separate from the user’s. Windows changes that machine password automatically (every 30 days by default) and stores the new one on both the PC and a domain controller. When the two copies get out of step, the PC can’t set up its secure channel to the domain and domain sign-ins fail with “The trust relationship between this workstation and the primary domain failed.”

Common reasons they get out of step:

• The PC or virtual machine was restored from an older backup, snapshot or system image, so it holds an old machine password.
• Someone reset or deleted the computer’s account in Active Directory, or another PC was joined with the same name.
• The PC was rebuilt or re-imaged but kept its old name.
• Less often, replication problems between domain controllers.

Your user account is fine. The fix is to resync the computer account, not to reset your password.

Step 1: Get signed in to the PC

You can’t sign in with your domain account while the trust is broken, so use one of these:

• A local administrator account: on the sign-in screen choose Other user and enter .\username (the dot means “this PC”) with the local account’s password. Many companies set unique local admin passwords per PC (for example with Windows LAPS), so IT can give you this.
• Cached domain credentials: unplug the network cable or turn off Wi-Fi from the network icon on the sign-in screen, then sign in with your normal domain account. If you’ve signed in on this PC before, Windows can often let you in from its cache because it can’t reach the domain to reject you. Reconnect the network once you’re at the desktop.

Some fixes below need the PC to reach a domain controller, so make sure it’s back on the company network (or VPN) before running them. If the PC can’t contact the domain at all, see “The Active Directory Domain Services is currently unavailable” and check the network connection first.

Fix 1: Repair the secure channel with PowerShell

This is the quickest fix and doesn’t need a restart before or a rejoin after. Use Windows PowerShell (version 5.1, built into Windows), not PowerShell 7, because these cmdlets are part of Windows PowerShell.

1. Select Start, type Windows PowerShell, right-click it and choose Run as administrator. If you’re signed in as a standard user, see how to run a program as a different user.
2. Check the channel. False confirms the trust is broken:

Test-ComputerSecureChannel

Repair it with a domain account that is allowed to reset this computer’s account. You’ll be asked for the password:

Test-ComputerSecureChannel -Repair -Credential CONTOSO\adminuser

Replace CONTOSO\adminuser with your domain and account. True means it worked. Restart and sign in with your domain account. To use a specific domain controller, add -Server DC01.contoso.com.

An alternative that does the same job is Reset-ComputerMachinePassword:

Reset-ComputerMachinePassword -Server DC01 -Credential CONTOSO\adminuser

It shows no output when it succeeds. Restart afterwards.

Fix 2: Reset the machine password with netdom

Admins who prefer the classic tool can use netdom. It’s built into Windows Server and, on Windows 11 or 10, comes with the RSAT Active Directory tools (see how RSAT tools are installed). From an administrator Command Prompt on the affected PC:

netdom resetpwd /server:DC01 /userd:CONTOSO\adminuser /passwordd:*

The * makes netdom ask for the password instead of showing it on screen. Restart once it reports success.

Fix 3: Remove the PC from the domain and join it again

If the repair commands fail, or you can’t reach a domain controller from the PC to run them, rejoining always rebuilds the trust. You need the local administrator password, because you’ll sign in locally in between.

1. Optional but useful: in Active Directory Users and Computers, an admin can right-click the computer and choose Reset Account. The PC then rejoins the same account and keeps its group memberships.
2. On the PC, press Win + R, type sysdm.cpl and press Enter. On the Computer Name tab select Change.
3. Choose Workgroup, type any name (for example WORKGROUP), select OK and restart.
4. Sign in with the local administrator account, open sysdm.cpl again, select Change, choose Domain, enter the domain name and a domain account that can join computers.
5. Restart and sign in with your domain account.

Your user profile stays on the PC, and signing in with the same domain account opens the same profile.

Check the fix and prevent it coming back

• Run Test-ComputerSecureChannel again. It should return True. Admins can also use nltest /sc_verify:contoso.com.
• For virtual machines, avoid reverting a domain-joined VM to an old snapshot. If you must, expect to repair the secure channel afterwards.
• Don’t clone a domain-joined PC’s disk to another PC without Sysprep, and don’t join two PCs with the same name.
• Make sure the PC’s clock is correct, because large time differences also stop domain sign-ins.

Turning off automatic machine password changes is sometimes suggested as a shortcut. Leave them on, because they’re a security control.

Related guides

• “The Active Directory Domain Services is currently unavailable”: how to fix it
• Group Policy Management Console on Windows 11: how to install and open it
• Windows 11 run as different user: 4 ways
• Ethernet doesn’t have a valid IP configuration: 7 fixes

Official sources: for more detail, see these pages:

• Microsoft Learn: Test-ComputerSecureChannel
• Microsoft Learn: Reset-ComputerMachinePassword

Frequently asked questions

Will I lose my files fixing this?

No. The repair only changes the computer’s account password. Even removing and rejoining the domain keeps your user profile and files on the PC.

Can I fix it without admin rights?

No. You need local administrator rights on the PC and a domain account allowed to reset or join computers. On a work PC, contact your IT team.

Why does it keep coming back on the same PC?

Usually because the PC or VM keeps being restored to an older state, or another device uses the same computer name. Fix the cause, not just the symptom.

Does restarting fix the trust relationship error?

Rarely. A restart doesn’t resync the machine password, so the error normally stays until you repair the secure channel or rejoin the domain.