Every enterprise systems administrator has encountered the dreaded logon error: "The trust relationship between this workstation and the primary domain failed." This occurs when a workstation's local machine account password stored in LSA secrets drifts out of synchronization with the computer object on the Active Directory Domain Controller—often following a snapshot restore, prolonged offline hibernation, or network interruption.
The Cost of Unjoining and Rejoining
The traditional Tier-1 helpdesk response is unjoining the PC from the domain to a workgroup and re-joining it. This destructive workaround destroys the local user profile associations, invalidates DPAPI encrypted certificates, resets Windows Hello for Business containers, and generates duplicate device records in Entra ID.
Test-ComputerSecureChannel.
PowerShell Secure Channel Diagnostics & In-Place Repair
# ==============================================================================
# Active Directory Secure Channel Diagnostic & In-Place Repair
# ==============================================================================
Write-Host ">>> [1/2] Testing Secure Channel to Domain Controller..." -ForegroundColor Cyan
$test = Test-ComputerSecureChannel -Verbose
if (-not $test) {
Write-Warning "Secure Channel is BROKEN. Initiating in-place password renegotiation..."
# Prompt for domain administrative credentials to reset the machine account password
$cred = Get-Credential -UserName "DOMAIN\admin_account" -Message "Enter Domain Admin credentials to reset computer trust"
$repairResult = Test-ComputerSecureChannel -Repair -Credential $cred -Verbose
if ($repairResult) {
Write-Host "✅ SUCCESS: Secure channel successfully repaired! No reboot or unjoin required." -ForegroundColor Green
} else {
Write-Host "❌ FAILED: Attempting fallback Reset-ComputerMachinePassword..." -ForegroundColor Red
Reset-ComputerMachinePassword -Credential $cred
}
} else {
Write-Host "✅ Secure channel is HEALTHY." -ForegroundColor Green
}
