mark++

I’ve got some Vista laptops and virtual machines which are joined to the NT domain at work, but tend to be disconnected from that network for long periods of time. Ordinarily, this would be fine, but domain policy requires that we change our passwords every month.

Sometimes I get the following message on a log in attempt:

The trust relationship between the workstation and the primary domain controller has failed.

In these cases I’m often positive that I’ve entered the correct username and current password. Alas the machine has been away too long, and has lost the domain’s trust.

Where were you? Why didn’t you call? Is that lipstick on your collar?

The good news is that you can remedy this situation by merely rejoining the domain. The bad news is that you need to log in to the machine in order to do that. This is complicated by the fact that, by default, Vista has the local administrator account disabled.

In theory, Vista has cached your old credentials and can validate against those without contacting the domain. Just provide your old password from a couple months ago, and you’re good to go. You remember it… right?

One critical point: if the machine is connected to the network, it seems that it will ignore the old locally-cached credentials and try to validate against the domain. This is guaranteed to fail, because of the broken trust relationship. So, before you start brute-forcing, unplug that Cat-5. Turn off that WiFi.

Once you are logged in, do this:

1. Leave the domain, do not reboot yet.
2. Enable the local administrator and set a password.
3. Reboot.
4. Log in as the local admin and rejoin the domain.

If you can’t remember your old password you may have to “flatten” your machine. This is probably a good time to consider Ubuntu.