News

Yet more on Lost Trust issues

It is not uncommon tyo try to log onto a Domain PC and get the dreaded 'Lost Trust' error message, which prevents Domain logons. We've covered this before on this site and the classic way to fix this used to be to 'logon locally, leave domain, re-join domain'. 

A better way is to use Power Shell which is quicker and avoids reboots.

But.. these all require a working local user admin account. What if you don't have one for some reason? Add to that the troublesome PC being several hundred kilometres away and with no on site support?

If, and only if, you have already installed the Manage Engine Desktop Central [MEDC] engine agent (probably as part of a patch and updating scenario) then what follows will help you fix the problem.

First of all, use the MEDC Remote access tool to get to the logon screen of the PC.

It's worth trying a few local accounts to confirm you really can't logon!

Then go to the MEDC remote cmd prompt. This will open a command window on your local PC which reflects what is running on the target PC - and it runs under the SYSTEM account!

This is a very high level accounts with the most privileges, which is the key to getting back into the system.

From the System cmd prompt, one can then create a local user - say root, with a password and then add that user to the local administrators group.

Net user /add root Password

Net localgroup administrators root /add

Once this is done, return to the MEDC remote terminal, and logon to the PC with the newly created local admin account.

Once you are back in, run the Power Shell command to reset the broken Trust relationship.

Test-ComputerSecureChannel -Repair -Credential (get-credential)

<< Go back to the previous page