Difference between revisions of "The trust relationship between this workstation and the primary domain failed"
(more stale records) |
|||
Line 74: | Line 74: | ||
samba-tool dns delete bob _msdcs.ad.pumpingstationone.org gc A ${IP4_Address} | samba-tool dns delete bob _msdcs.ad.pumpingstationone.org gc A ${IP4_Address} | ||
samba-tool dns delete bob _msdcs.ad.pumpingstationone.org gc AAAA ${IP6_Address} | samba-tool dns delete bob _msdcs.ad.pumpingstationone.org gc AAAA ${IP6_Address} | ||
+ | |||
+ | I had a lot of stale entries, as ip address have changed before. | ||
+ | |||
+ | ==== _tcp.gc ==== | ||
+ | |||
+ | samba-tool dns query bob _msdcs.ad.pumpingstationone.org _tcp.gc ALL | ||
+ | |||
+ | delete SRV records poining to removed machines | ||
+ | |||
+ | samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _ldap._tcp.gc SRV 'vm.ad.pumpingstationone.org. 3268 0 100' | ||
+ | |||
+ | |||
+ | === _tcp.dc === | ||
+ | |||
+ | samba-tool dns query bob _msdcs.ad.pumpingstationone.org _tcp.dc ALL | ||
+ | |||
+ | delete the extra records for _ldap and _kerberos | ||
+ | |||
+ | samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _kerberos._tcp.dc SRV 'vm.ad.pumpingstationone.org. 88 0 100' | ||
+ | samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _ldap._tcp.dc SRV 'vm.ad.pumpingstationone.org. 389 0 100' | ||
+ | |||
+ | === _tcp.pdc === | ||
+ | |||
+ | samba-tool dns query bob _msdcs.ad.pumpingstationone.org _tcp.pdc ALL | ||
+ | |||
+ | delete the extra _ldap records: | ||
+ | |||
+ | samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _ldap._tcp.pdc SRV 'vm.ad.pumpingstationone.org. 389 0 100' | ||
+ | |||
+ | === _tcp records === | ||
+ | |||
+ | samba-tool dns query bob ad.pumpingstationone.org _tcp ALL | ||
+ | |||
+ | delete the extra _gc, _kerberos, _kpasswd, and _ldap records | ||
+ | |||
+ | samba-tool dns delete bob ad.pumpingstationone.org _gc._tcp SRV 'vm.ad.pumpingstationone.org. 3268 0 100' | ||
+ | samba-tool dns delete bob ad.pumpingstationone.org _kerberos._tcp SRV 'vm.ad.pumpingstationone.org. 88 0 100' | ||
+ | samba-tool dns delete bob ad.pumpingstationone.org _kpasswd._tcp SRV 'vm.ad.pumpingstationone.org. 464 0 100' | ||
+ | samba-tool dns delete bob ad.pumpingstationone.org _ldap._tcp SRV 'vm.ad.pumpingstationone.org. 389 0 100' |
Revision as of 19:03, 19 July 2014
The Issue
Some of the computers on the network display this error:
The trust relationship between this workstation and the primary domain failed.
No user is able to log in.
Potential Solutions
Reboot
Sometimes rebooting clears the error as a workaround
Setup Time Sync
w32tm /config /manualpeerlist:bob.ad.pumpingstationone.org,0x8 /syncfromflags:MANUAL w32tm /config /update net stop w32time net start w32time w32tm /resync
Also check the timezone is correct.
Fixes a Potential problem where kerberos and the AD server get out of sync. Has failed to permanently resolve the problem on sliceyToo, but did make it go away for a day while rebooting failed.
Reset Machine Password
netdom RESETPWD /Server:bob /UserD:PS1\hef /PasswordD:*
Attempted on sliceyToo, has not yet been attempted elsewhere.
Reference: DON'T REJOIN TO FIX I have tried rejoining the computers to domain. It didn't fix.
Remove Stale Entries to the Old Domain Controller from ldap
The previous Domain Controller with all the FSMO roles was named vm. It died a sudden death and was not cleanly demoted from the domain.
cleaning out the _msdcs record
Find the extra entry
samba-tool dns query bob _msdcs.ad.pumpingstationone.org @ ALL Name=, Records=2, Children=0 SOA: serial=5, refresh=900, retry=600, expire=86400, minttl=0, ns=vm.ad.pumpingstationone.org., email=hostmaster.ad.pumpingstationone.org. (flags=600000f0, serial=5, ttl=3600) NS: vm.ad.pumpingstationone.org. (flags=600000f0, serial=1, ttl=900) Name=8e76c887-c322-4e20-98df-372fa8801c44, Records=1, Children=0 CNAME: vm.ad.pumpingstationone.org. (flags=f0, serial=110, ttl=900) Name=dc, Records=0, Children=2 Name=domains, Records=0, Children=1 Name=e3fac096-8349-4e28-8fda-91d32e6ec7c0, Records=1, Children=0 CNAME: bob.ad.pumpingstationone.org. (flags=f0, serial=110, ttl=900) Name=gc, Records=0, Children=2
In this case, the extra record is the one that resolves to vm.ad.pumpingstaitonone.org: 8e76c887-c322-4e20-98df-372fa8801c44
Delete it:
samba-tool dns delete bob _msdcs.ad.pumpingstationone.org 8e76c887-c322-4e20-98df-372fa8801c44 CNAME vm.ad.pumpingstationone.org
GC (NETLOGON)
samba-tool dns query bob _msdcs.ad.pumpingstationone.org gc ALL
Delete A or AAAA record that is not a Domain controller
samba-tool dns delete bob _msdcs.ad.pumpingstationone.org gc A ${IP4_Address} samba-tool dns delete bob _msdcs.ad.pumpingstationone.org gc AAAA ${IP6_Address}
I had a lot of stale entries, as ip address have changed before.
_tcp.gc
samba-tool dns query bob _msdcs.ad.pumpingstationone.org _tcp.gc ALL
delete SRV records poining to removed machines
samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _ldap._tcp.gc SRV 'vm.ad.pumpingstationone.org. 3268 0 100'
_tcp.dc
samba-tool dns query bob _msdcs.ad.pumpingstationone.org _tcp.dc ALL
delete the extra records for _ldap and _kerberos
samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _kerberos._tcp.dc SRV 'vm.ad.pumpingstationone.org. 88 0 100' samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _ldap._tcp.dc SRV 'vm.ad.pumpingstationone.org. 389 0 100'
_tcp.pdc
samba-tool dns query bob _msdcs.ad.pumpingstationone.org _tcp.pdc ALL
delete the extra _ldap records:
samba-tool dns delete bob _msdcs.ad.pumpingstationone.org _ldap._tcp.pdc SRV 'vm.ad.pumpingstationone.org. 389 0 100'
_tcp records
samba-tool dns query bob ad.pumpingstationone.org _tcp ALL
delete the extra _gc, _kerberos, _kpasswd, and _ldap records
samba-tool dns delete bob ad.pumpingstationone.org _gc._tcp SRV 'vm.ad.pumpingstationone.org. 3268 0 100' samba-tool dns delete bob ad.pumpingstationone.org _kerberos._tcp SRV 'vm.ad.pumpingstationone.org. 88 0 100' samba-tool dns delete bob ad.pumpingstationone.org _kpasswd._tcp SRV 'vm.ad.pumpingstationone.org. 464 0 100' samba-tool dns delete bob ad.pumpingstationone.org _ldap._tcp SRV 'vm.ad.pumpingstationone.org. 389 0 100'