netdom reset how to use

Question

Hello

I have Microsoft MCSE AD book beside my hand. I also read "netdom help reset", I also had made many google.
But I still have question about it. Would you please help me?
Thank you very much.

NETDOM RESET machine [/Domain:domain] [/Server:server]
[/UserO:user] [/PasswordO:[password | *]] [/SecurePasswordPrompt]

I have a PC1 lost trust with dc1.doamin.com. I had try to "reset account" in "AD users and computers." but no help.
q1: where should I run netdom reset?
q2: for domain, I should input /Domain:domain.com ?
q3: for server, I should input /Server:dc1.domain.com
q4: for user, I should use domain admin? or PC1 local admin or any else?
q5: I will ignore option /SecurePasswordPrompt, am I right.

Thanks for your time.

Answer 1

Hello,

Thank you so much for posting here.

As mentioned, we have PC1 lost trust with dc1.domain.com. Then we will encounter the error message "The trust relationship between this workstation and the primary domain failed" when logging on PC1.

If so, to resolve the error message, we can run the command **Netdom resetpwd /s:target_server /ud:mydomain\domain_admin /pd:***on the PC1.

/s:server is the name of the domain controller to use for setting the machine account password. This is the server where the KDC is running. /ud:domain\User is the user account that makes the connection with the domain you specified in the /s parameter. This must be in domain\User format. If this parameter is omitted, the current user account is used. /pd:* specifies the password of the user account that is specified in the /ud parameter. Use an asterisk (*) to be prompted for the password.

For example, my domain name is a.local:

Or we could choose to reset the secure connection between a workstation and a domain controller using Netdom reset. Syntax is

**NETDOM RESET machine [/Domain:domain] [/Server:server] [/UserO:user] [/PasswordO:[password | *]] [/SecurePasswordPrompt]**

say user account name is X, computer name is PC1, Domain name is : domain.com, server name : dc1

so

netdom reset PC1 /d:domain.com /S:dc1 /U:X /P:*

(and run it on the DC)

As for user, specifies the user account to use to make the secure connection with the computer that you want to reset. If you do not specify this parameter, then netdom reset uses the current user account. We could choose to use domain admin.

Reference: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc788073(v=ws.11)

For any question, please feel free to contact us.

Best regards, Hannah Xiong

============================================ If the Answer is helpful, please click "Accept Answer" and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Dear Scott,

You are welcome. Thank you so much for kindly reply.

I understand that we would like to do more tests. But as far as I know, it could not manual make secure channel broken. Besides, I would not recommend to manual break secure channel. We might have a try If it is in the test environment. But I have no idea how to manual do this. Below are some reasons for the problem of secure channel. Maybe we could get some inspiration.

There are many reasons for the problem of Secure Channel. For example,

-Try to add a computer with the same name to the domain. According to the feedback we have received from customers, this factor has caused the most problems. When we join the computer to the domain",if there is a computer account with the same name in the current domain, reset the account password. This process will cause problems with the previous system that uses the computer account.

-Synchronization problems between DCs. For example, after the client saves the password to DC1, the client may use DC2 the next time it starts, but the replication between DC1 and DC2 is not completed in time (or cannot). This may cause Secure Channel errors. This is the second most common situation.

-The password of the local LSA is changed or rolled back. This situation is not very common. It usually occurs when the system is restored or the snapshot of the virtual machine is rolled back. Of course, it may also happen to the hard disk. Or in the case of a file system error. For example, the disk cache did not write back normally after a power failure.

-Non-persistent network connection problem. This situation is relatively rare.

Thank you so much for your support.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.