Users loosing trust relationship with the domain controller

Question

Dear Experts,

 

I have 3 Domain Controllers, 2 in Site A, 1 in Site B. 

 

Whenever user changes any password, his PC loses trust relationship with the domain controller, and gives below error:

 

"The Security Database on the server does not have a computer account for this workstation trust relationship."

 

beside i have seen a lot of below errors in eventviewer of Domain Controller for different workstations:

 

Event ID 5722:

The session setup from the computer HR-13535-TR failed to authenticate. The name(s) of the account(s) referenced in the security database is HR-13535-TR$.  The following error occurred:  Access is denied.

 

Event ID 5723:

The session setup from computer 'HR-19092-TR' failed because the security database does not contain a trust account 'HR-19092-TR$' referenced by the specified computer.   USER ACTION   If this is the first occurrence of this event for the specified computer and account, this may be a transient issue that doesn't require any action at this time.  If this is a Read-Only Domain Controller and 'HR-19092-TR$' is a legitimate machine account for the computer 'HR-19092-TR' then 'HR-19092-TR' should be marked cacheable for this location if appropriate or otherwise ensure connectivity to a domain controller  capable of servicing the request (for example a writable domain controller).  Otherwise, the following steps may be taken to resolve this problem:   If 'HR-19092-TR$' is a legitimate machine account for the computer 'HR-19092-TR', then 'HR-19092-TR' should be rejoined to the domain.   If 'HR-19092-TR$' is a legitimate interdomain trust account, then the trust should be recreated.   Otherwise, assuming that 'HR-19092-TR$' is not a legitimate account, the following action should be taken on 'HR-19092-TR':   If 'HR-19092-TR' is a Domain Controller, then the trust associated with 'HR-19092-TR$' should be deleted.   Event ID: 37:

The Key Distribution Center (KDC) encountered a ticket that did not contain information about the account that requested the ticket while processing a request for another ticket. This prevented security checks from running and could open security vulnerabilities. See https://go.microsoft.com/fwlink/?linkid=2173051 to learn more.  Ticket PAC constructed by: DC001  Client: Domain_Name\ICT-12260-TR$  Ticket for: krbtgt  

There are other, but these are most common one's, any help will be highly appreciated.

 

Thanks

Answer 1

When users lose trust relationships with the domain controller, it typically means that the secure channel between the workstation or server and the domain controller has been broken. Here’s how to resolve it:

1. Rejoin the Domain:
   • Log in with local admin credentials.
   • Remove the affected machine from the domain by adding it to a workgroup.
   • Restart the machine.
   • Rejoin the machine to the domain.
   • Restart again.
2. Reset the Computer Account in Active Directory:
   • Go to Active Directory Users and Computers.
   • Locate the computer account.
   • Right-click and choose "Reset Account."
   • Rejoin the domain if necessary.
3. Use PowerShell (if applicable):
   • Run the following command in PowerShell on the affected machine:

          Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
          
     

Answer 2

In Event ID 5722, it says that HR-13535-TR failed to authenticate as in the security database he couldn't found HR-13535-TR$.

It seems that it is adding "$" after computer name. can it be the issue?

Answer 3

Hello,

 

Thank you for posting in Q&A forum.

This issue could be caused by the domain trust lost.

To fix this issue, please try below steps:

1.Run below PowerShell command to check domain relationship:

Test-ComputerSecureChannel –Verbose

If it's False please run command:

Test-ComputerSecureChannel -Repair -Credential DOMAIN\Administrator -Verbose

to repair the relationship.

 

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

 

Best regards，

Jill Zhou

 

---

If the Answer is helpful, please click "Accept Answer" and upvote it.