Active Directory · Troubleshooting guide

Active Directory Troubleshooting: Broken Trust Relationships, Kerberos Time Skew and Missing GPOs

Fast, safe fixes for workstation trust failures, Kerberos time-skew errors, and group policies that silently stop applying.

Published August 28, 2026 · RCW IT Training

Trust and authentication

'The trust relationship between this workstation and the primary domain failed'

The machine account password diverged. Quick fix without a rebuild: run Test-ComputerSecureChannel -Repair locally as a domain admin, or netdom reset <computer> /domain:<dom>. If the channel keeps breaking, look for duplicate computer objects, a restored VM snapshot rolling back the machine password, and time skew. Rejoin only as a last resort - repair preserves the SID and profile.

Kerberos KRB_AP_ERR_SKEW or time-skew logon failures

Kerberos tolerates five minutes of skew. Fix the hierarchy: PDC emulator syncs from external NTP (w32tm /config /manualpeerlist:... /syncfromflags:manual /reliable:yes /update), all DCs sync from the domain hierarchy, members from DCs. Verify with w32tm /monitor. On virtualised DCs disable VM time-sync integration or snapshots will re-break time.

GPO application

A new GPO applies in some sites but not others

GPOs replicate in two lanes: the policy object in SYSVOL (files) and its link in AD (directory). A DC can have the link but not the files. Check gpresult /h, which DC the client used, and DFSR health. Also review security filtering, WMI filters, and read permission for Authenticated Users - MS16-072 changed the default apply context.

Key takeaway: Repair trust channels before rejoining, fix the time hierarchy at the PDC emulator, and remember that GPOs replicate twice - directory and SYSVOL.