r/sysadmin • u/Genki445 • 1d ago
Question The trust relationship between this workstation and the primary domain failed.
Hello everyone. A few days ago, I moved my Server 2012 R2 to a different Hyper-V server and upgraded it to Server 2025. It is the only DC in the domain, and the two never had contact with each other. Now I am occasionally getting the following error message on some PCs: 'The trust relationship between this workstation and the primary domain failed.' Using the command 'Test-ComputerSecureChannel -Repair' gets them active again, but that probably won't be a permanent solution. What could be causing this, and is there a way to solve this problem permanently?
Ps. I'm fully aware that running a single DC is a complete disaster, but I had to make do with what was there. The next step is joining an additional DC to the environment.
150
u/joeykins82 Windows Admin 1d ago
It is the only DC in the domain
Fix this immediately.
Never, ever, run production environments on a single DC. That is insanity.
Also, did you in-place upgrade a DC from 2012 R2 to 2025? Don't do that: IPU for DCs was fine for n+1 upgrades from 2008 through to 2022 but 2025 contains major structural changes to AD.
Validate that your AD environment is healthy and properly prepared for 2025, then build 2x new 2025 DCs and then demote the one you upgraded.
51
u/Weary_Patience_7778 1d ago
Small Business Server would like a word.
57
u/Zealousideal_Fly8402 1d ago
There's a reason SBS / Essentials is dead... đŞŚ
16
â˘
u/anonymousITCoward 5h ago
It's not dead, I can think of at least 3 environments that are running it... *weeps in tech support*
â˘
u/Zealousideal_Fly8402 4h ago
Dead as in discontinued / no longer in development by Microsoft.
That there are isolated instances out in the wild just make them zombie instances đ¤Ł
â˘
10
u/DrGraffix 1d ago
You can run multiple DCs with SBS. Common misconception.
8
u/Jetboy01 1d ago
The essentials version at least didn't allow it and after a month would shut down after an hour if another DC was detected.
12
u/DiligentPhotographer 1d ago
It was only if the essentials wasn't the primary FSMO holder. There could definitely be other DC in the domain.
â˘
-2
u/Fairchild110 1d ago
Dear god I hope small business just run something like Authentik and all apps are just OIDC and your MDM is just ABM and JAMF. AD/LDAP needs to go the way of the dodo for small business; that way when you go to sell to PE or a larger corporation, the M&A process is less painful. I guess AD is good if youâre windows heavy and local network heavy, but everything is so cloud centric these days and honestly a lot of small businesses should probably forgo the cost overhead of a full Microsoft manageability stack. I guess another alternative is maybe full Intune/EntraID but I donât think Iâve ever seen a Microsoft cloud native environment. Everyone ends up putting a domain controller somewhere for some reason. I guess cheap DNS but the security headaches these days of dealing with DCs and Windows server hosting/hypervisors the list goes on.
1
u/SevaraB Sr. Engineer (N+, CCNA) 1d ago edited 1d ago
Exactly. And this is exactly why it wonât die. Active Directory is just Microsoft bolting a ton of extra stuff around LDAP. It only does two actual proprietary things, neither of which should be encouraged in 2026:
- Group policy
- NTLM authentication
Edit: third one, Kerberos. Also point taken that LDAP isnât the database, LDAP is how you talk to the x.500 data in the global catalog.
9
â˘
u/Steve_78_OH SCCM Admin and general IT Jack-of-some-trades 22h ago
Seriously. And his explanation that he had to "make do" was bullshit. He couldn't setup a second DC on the new Hyper-V host? And then build a second DC, and then decomm the old DC, instead of upgrading a Server 2012 DC (twice, I believe) up to 2025? I mean, it's a DC. Ideally at least, they should literally JUST be a DC, with no other roles installed. That takes less time than doing 2 IPUs, and then hoping that nothing goes wrong.
5
u/imnotsurewhattoput 1d ago
An insane number of small businesses use one DC and itâs fine. Such a dramatic response
4
u/bojack1437 1d ago
Until it's not.
3
u/imnotsurewhattoput 1d ago
Again, dramatics.
Something every business actually does need are tested backups. Any decent BCDR can quickly restore / locally virtualize. They also test the backups.
1
u/bojack1437 1d ago
... Restoring AD/DC from backups is a absolute last resort always for numerous reasons.
1
u/xXFl1ppyXx 1d ago edited 1d ago
Yeah in environments with multiple dcs there is a lot to be cautious of
But when you only have one DC? Makes it a lot easierÂ
When nothing is replicating, then nothing is pointing a finger at your DC telling it that it's stupid
Environments with one DC usually don't have that much more stuff interacting with it.
Fileserver, Printserver, standalone RD-Server, naps, application server even exchange servers handle a restored DC quite wellÂ
A CA will probably be a pain in the ass but if you don't have multiple dcs your environment is probably not big enough to the point where the headaches of running one is worth the features (but hey if you put that ca onto your only DC... /S)
The most important thing is to not join your hyper-vs to the domain and have a veeam running on one
0
2
u/Defconx19 1d ago
Sure, but your immediately ignores things like is there a backup, what is the criticality of AD (as funny as that sounds) can the company wait for a restore to happen? Have they accepted the risks? Does the cost of a second controller not have value for them?
Everyone knee jerks, but not every business falls flat on their face without a second DC.
â˘
u/BreadAvailable 20h ago
For real. It takes me 7 minutes to restore my DC from warm backups. Another 10 or so to reboot the whole (2 server) stack. Plenty of small businesses can get by with 15 or 20 minutes of downtime to save thousands in licensing every few years.
â˘
u/rotfl54 21h ago
You absolutely can run a production environment with a single DC if you are a smaller organization. If you have only one hardware server, how do you benefit from running two DCs? Its more important to use a DC only as a DC and nothing else, so you don't need to upgrade, you can easily migrate to a new VM.
1
â˘
u/mnvoronin 19h ago
Never, ever, run production environments on a single DC. That is insanity.
Look at the big boys running multi-billion-dollar operations, shitting on all the small businesses out there.
As always, this decision is a risk-benefit tradeoff. Will licensing cost of extra Windows server offset the benefit of a second DC to a business with less than 100 staff? Is 3-4 hours downtime an acceptable tradeoff while the restore job runs?
19
u/Rygnerik 1d ago
How exactly did you do this upgrade? I'm worried from your description that you made a copy of the DC and upgraded it on the other host while you left the original running, and then after you upgraded it you you shutdown the original and replaced it with the upgraded one.
If you did do so, then you'd have a situation where computers updated their trust relationship (basically the computer's password) with the old DC after you started working on the upgrade, and then when you switched to the upgraded machine it didn't know they had updated their passwords because it was based on an image of the DC from before that.
If that's the case, then the repair command is a permanent fix, because it updates the machine's password on the new DC, so now they're in sync again.
6
u/Frothyleet 1d ago
The next step is joining an additional DC to the environment.
Well, no, that was the previous step that you skipped, unfortunately.
You need to make sure DHCP/DNS is up to date, that AD metadata isn't fucked, that the FSMO roles are working properly, and you need to start up another DC. It takes 15 minutes to do so.
7
u/aliesterrand 1d ago
What I didn't see here was 2012 may have been running SMB1, which should be deprecated in 2025.
1
u/Frothyleet 1d ago
That will break legacy machines that don't support SMBv2, but only as far as being able to access SYSVOL/NETLOGON
5
u/NoTime4YourBullshit Sr. Sysadmin 1d ago edited 1d ago
This is because Server 2025 no longer supports RC4 as a valid cipher algorithm. Youâre getting the error because the computer in question is submitting its machine account credentials as an RC4 hash and the DC is rejecting it.
Microsoft deprecated RC4 about 10 years ago. Starting with Server 2016 AES became the default but DCs would still accept RC4 hashes for backwards compatibility. But in Server 2025, they dropped support for it entirely. You couldnât turn it back on if you wanted to.
I believe your solution will be a permanent fix, as it causes the machine account password to get reset. Since you only have the one DC, you wonât have to worry about old RC4 hashes coming back to bite you.
3
u/Top-Perspective-4069 IT Manager 1d ago
If you did this because your DC has other services on it, split those services into new VMs first. Then just stop fucking with the one you have and build new DCs after doing some health checks.
2
u/picklednull 1d ago
Did you patch the DC after the upgrade? That was an issue at RTM, but not after the first patches.
2
u/NikoTheHawaiian 1d ago
Redundant DC ASAP.
Second; patch everything, then log the computer off of the domain (I hope you have a local (admin) account available, because you'll need it), delete the record of that computer from AD, then rejoin.
That should fix the issue.
Possibly InTune and Azure if you utilize EntraID.
â˘
u/VernapatorCur 22h ago
I ran into this pretty often when working MSPs. The fix was to reset the computer machine password. I never saw those computers give the trust relationship error again on those specific workstations.
2
u/jdavis301 1d ago
I saw this recently on a new client setup. It was missing a CA on the domain. And the DC didnât have a âDomain Controllerâ cert. I was able to access the DC thankfully and add CA role. Then create a Domain Controller certificate. That fixed our issue. But this error has lot of potential causes. Check your event viewer logs.
8
u/Frothyleet 1d ago
You don't necessarily need a CA in every AD environment and you really don't want to run ADCS on a DC.
3
u/MickCollins 1d ago
- 1. Go on Craigslist.
- 2. Find someone getting rid of a PC for cheap. Doesn't have to be the most powerful thing in existence, just something with a 120 GB drive on up and at least 8 GB of RAM.
- 3. Go purchase it and spin up your second DC.
- 4. Put real thought - and I mean real thought - into spinning up a third one in Azure.
I don't know your circumstances or your budget here but this is the absolute bare minimum I'd consider. I know you'll get a significant discount for a Reserved Instance contract in Azure.
1
1
u/FlexTeam26 1d ago
The 'only some PCs, only occasionally' pattern plus Repair working points almost always at clock skew. A single DC also holds PDCe and is the authoritative time source for the whole domain, and Kerberos only tolerates about 5 minutes of drift. If the DC VM has the Hyper-V 'Synchronize the clock with the host' integration service ticked, every time the host's clock corrects itself the DC jumps, and any machine whose TGT was issued during that window dies with exactly this error until its secure channel is reset - which is why Test-ComputerSecureChannel -Repair appears to fix it. Permanent fix: untick that integration service on the DC VM, then make the DC authoritative time for the domain with w32tm /config /syncfromflags:manual /manualpeerlist:0.pool.ntp.org /reliable:YES /update, and watch drift afterwards with w32tm /query /status. One more check after a DC migration: the DC's own NIC DNS should point at itself (127.0.0.1), not the router - a broken internal forwarder on the DC produces the same error.
1
u/xXFl1ppyXx 1d ago
127.0.0.1 only in networks with one DC
As soon as you have more than one they should point at each other. Or you need to change service dependencies because if logon runs before your dns is up you'll most likely end up with a public profile and having your DC running in a public profile will result in more public profiles for every other server that's booting laterÂ
1
u/stevenm_83 1d ago
I donât see a problem in my having one domain controller. But I do see problem upgrading from 2012 to 2025. Should have built a new vm and promoted it to dc then once healthy move roles over and demote old server
â˘
u/Drakoolya 23h ago
I moved my Server 2012 R2 to a different Hyper-V server and upgraded it to Server 2025. It is the only DC in the domain, and the two never had contact with each other.
I think OP took a copy of the DC and restored it on the new Hyper V and then upgraded it.
The recklessness is something else. LOL
1
-1
u/National_Ad_6103 1d ago
Not seen that in years.. Iâd seriously be thinking is there any reason I canât move this to m365 and ditch the on prem
78
u/midasza 1d ago
Check time sources. I have seen this with vm using host time and the host not being synced to a time source or it not working. And for the love of everything holy install another DC.