The trust relationship between this workstation and the primary domain failed" helpdesk fix

TL;DR

The workstation's machine password fell out of sync with Active Directory. Reset the secure channel with PowerShell from an elevated session; if that fails, remove and rejoin the domain. Most cases resolve in ten minutes without a reimage.

The query

"The trust relationship between this workstation and the primary domain failed" helpdesk fix

Use this when

• domain logon fails with the trust relationship message
• cached credentials work but network logon does not
• the computer account still exists in Active Directory

Not for

• sign-in failures on Entra ID joined-only devices
• wrong user password (the error names the workstation, not the account)
• Azure AD PRT or SSO token problems

Steps

1. Log on with a cached domain account or a local admin account so you can work on the machine. Expected output: you reach an elevated PowerShell prompt on the affected workstation.
2. Run Test-ComputerSecureChannel and confirm it reports False, which proves the trust is broken rather than a network outage. Expected output: the command returns False.
3. Run Reset-ComputerMachinePassword against the domain while the machine has line of sight to a domain controller. Expected output: the command completes with no error and Test-ComputerSecureChannel returns True.
4. Reboot and have the user sign in with their domain credentials. Expected output: logon succeeds on the first attempt.
5. If the reset fails, run Remove-Computer then Add-Computer to rejoin the domain, keeping the same computer name, then reboot. Expected output: the machine rejoins cleanly and domain logon works.

Applies to

Windows 10/11 domain-joined workstations, Windows Server, Active Directory Domain Services, PowerShell 5.1+. Works whether the machine talks to the DC over LAN or VPN.

Variant phrasings

The security database on the server does not have a computer account for this workstation

Same fix path, but step 3 is more likely to fail and you will go straight to the rejoin in step 5.

Trust relationship failed right after a machine restore or snapshot revert

The restored machine has an older machine password. Reset the secure channel or rejoin; also check the image for a duplicated computer name.

Why it happens

Domain members rotate a machine password with the domain roughly every 30 days. If the machine is offline long enough, restored from an old snapshot, or its account was reset, the two sides disagree and the DC refuses the trust.

Edge cases

• A duplicated computer name on the network re-breaks the trust after every fix; rename one machine.
• Check time skew too: large clock differences produce similar logon failures.
• Over VPN, confirm DNS resolves the DC and UDP/TCP 445 and 389 are reachable before rejoining.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1-aDJdeDEV11KfWceGCDNg