Worse yet, there would still be orphaned references to the computer account scattered elsewhere in the Active Directory (you can see these references by using the ADSIEdit tool).

By doing so, you would lose all of the configuration information for that server. So with that in mind, imagine that a trust relationship was accidentally broken and you decided to fix the problem by deleting the Exchange Server's computer account and rejoining the computer to the domain. The reason why I mention this particular example is that the Exchange Server configuration data is stored within the computer object for that server. In fact, it is possible to completely rebuild a failed Exchange Server from scratch (aside from the mailbox database) simply by making use of the configuration data that is stored in the Active Directory. All of the Exchange Server configuration data is stored within the Active Directory. However, this is the only significant data that is stored locally on Exchange Server. Exchange Server stores messages in a mailbox database residing on a mailbox server. The reason for this has to do with the way that some applications use the Active Directory. This approach works really well for workstations, but it can do more harm than good if you try it on a member server. Doing so reestablishes the broken-trust relationship. The easy fix is to blow away the computer account within the Active Directory Users and Computers console and then rejoin the computer to the domain. So how can you fix this error? Unfortunately, the simplest fix isn't always the best option.

If the copy of the computer account password that is stored within the member server gets out of sync with the password copy that is stored on the domain controller then the trust relationship will be broken as a result. However, in Active Directory environments each computer account also has an internal password. The reason why this problem happens is because of a 'password mismatch.' Passwords are typically thought of as something that is assigned to a user account. An authoritative domain controller restoration can trigger this error on workstations and member servers.

You can see the actual error message in Figure 1. This error message stated that the trust relationship between the workstation and the primary domain failed. After the restoration, all of the other servers in the domain displayed an error message at log in. In doing so, they accomplished basically the same thing that they would have if they had performed an authoritative restoration on a domain controller in a larger organization.Īlthough the restore operation succeeded, it had some unforeseen consequences. This restoration effectively reverted the Active Directory to a previous version. Earlier this week I saw a situation in which someone with a small, single-domain controller network performed a restoration of their domain controller.

Remove pc from domain windows 7