Trust Relationship Issues

Question

All the computers on my domain have domain trust issues. I am able to login perfectly into the domain without cached credentials but the following always happens:
What errors do you see?
PS C:\WINDOWS\system32> test-computersecurechannel
False

The secure channel always fails. If I do decide to remove it from the domain and put it back on, it works but only for a short period of time. Sometimes minutes or hours.

What's the environment and are there recent changes?
This happens on any client computer. Windows10, 7, XP, Vista. There have been no recent changes that could cause this.

What have you tried to troubleshoot this?
I have attempted to check for duplicate computers in Active Directory. Try to check event logs for anything that I see. I've tried reseting the machine password, checking replication health between servers and everything seems fine. About a month ago, this was happening to every computer minus around 5 but now it happens on every single computer, even a new one that was just purchased brand new.

Answer 1

I'd read on here about CVE-2020-1472 that was deployed with August update.
https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc

I have an Event ID 5827 for a Windows device. I thought you said Windows is not impacted?
By default, supported versions of Windows that have been fully updated should not be using vulnerable Netlogon secure channel connections. If an event ID 5827 is logged in the system event log for a Windows device:
Confirm that the device is running a supported versions of Windows.
Ensure the device is fully updated from Windows Update.
Check to ensure that Domain member: Digitally encrypt or sign secure channel data (always) is set to Enabled in a GPO linked to the OU for all your DCs, such as the default domain controllers GPO.

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Please run;

Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\problemworkstation.txt

then put unzipped text files up on OneDrive and share a link.

Answer 3

Here are the requested files: https://1drv.ms/u/s!AgQfsRUXJ_2CjBZBvXZiw-ifh7qw?e=9u5Cbb

Answer 4

Hi,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,
Vicky