Trust relationship failed MS Server 2025

Question

Trust relationship failed MS Server 2025

John Danahey 0

We have a Virtual Machine (server), that we cannot administer due to this error. We have attempted to log into the console with the built in admin account and get a password failure, we did not forget the password! Are there workarounds that would enable us to regain control, or is this a MS Engineering support request?

Kate Pham (WICLOUD CORPORATION) 825 Reputation points Microsoft External Staff Moderator

2026-03-02T06:42:04.48+00:00
Hey John. Thank you for contacting Microsoft Q&A community and sorry that you’re hitting that “trust relationship” snag on your Server 2025 VM.

Please help refer to bellow workarounds to address the issue.

Reset the built-in/local administrator password

In the Azure portal go to your VM → Operations → Run command → Reset password.

This lets you log back in locally even if the domain secure channel is broken.

Check and repair the secure channel

RDP in with your newly reset local admin account, open PowerShell as Administrator, and run:

Test-ComputerSecureChannel -Verbose

If it reports Healthy, try logging in again with your domain account.

If it reports Broken, repair it:

Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

Should that still fail, reset the machine account password:

Reset-ComputerMachinePassword -Credential (Get-Credential)

Unjoin/rejoin the domain (last resort)

If the above commands don’t stick, remove and re-add your VM to the domain

Verify network connectivity to your domain controller

On the VM run:

set | find /i "LOGONSERVER"

Test-Connection yourDC.contoso.com

If you get timeouts, check your NSGs, UDRs, VPN/ExpressRoute or firewall rules.

Windows Server 2025 quirk

There was a known domain-join issue on some Server 2025 images that’s fixed in KB5064489. If your OS build predates that update, install KB5064489 before re-joining the domain.

Hope that helps you regain control!

Reference list

Troubleshoot a failed trust relationship in an Azure Windows VM https://learn.microsoft.com/troubleshoot/azure/virtual-machines/windows/troubleshoot-broken-secure-channel

Azure VMAccess extension (reset password) https://learn.microsoft.com/azure/virtual-machines/extensions/vmaccess-windows

KB5064489 out-of-band update for Windows Server 2025 https://www.catalog.update.microsoft.com/Search.aspx?q=KB5064489

If you believe this information adds some value, please accept the answer so that your experience with the issue would help contribute to the whole community.

T&R,

Kate.

1 answer

Your answer

Answer 1

The error indicates a broken secure channel (trust relationship) between the VM and the domain. The built‑in local Administrator password failure is a separate issue: either the local password is no longer what is expected (for example, due to restore/rollback) or the account being used is not actually the local Administrator.

From the provided information, the supported recovery paths are:

Repair the secure channel (if you can get any remote/console access with domain creds) If a domain account can still log on (for example via PowerShell remoting from another machine where domain auth works), repair the machine account password/secure channel:
```
   $cred = Get-Credential   # domain admin credentials
   Invoke-Command -ComputerName "Server01" -ScriptBlock {
       Reset-ComputerMachinePassword -Credential $using:cred
   }
```
Or, from an interactive session on the server (if you can get one):
```
   Test-ComputerSecureChannel -Repair -Credential *
```
Then restart the server.

If secure channel repair fails: remove and re‑join the domain Once you have any working logon (local or domain), use PowerShell to unjoin and rejoin:

   # Unjoin
   Remove-Computer -UnjoinDomaincredential Domain01\Admin01 -PassThru -Verbose -Restart
   
   # After reboot, log on with local admin, then rejoin
   Add-Computer -ComputerName Server01 -LocalCredential Server01\Admin01 `
       -DomainName Domain02 -Credential Domain02\Admin02 -Restart -Force

If no credentials work at all (local or domain) The documentation in context does not provide a supported procedure to reset a forgotten/invalid local Administrator password on a domain‑joined server. In this situation, and especially for a production Windows Server 2025 VM, this becomes a support case:
- For Azure VMs: use the platform tools first (Reset password / VMAccess extension, Serial Console, redeploy, etc.). If those do not restore access, open an Azure support request.
- For on‑prem or non‑Azure virtualization: engage Microsoft Support, as offline password manipulation or unsupported SID/identity changes can break security and supportability (especially with clustering/SQL/AD roles).

Given that both domain logon (trust) and local Administrator logon are failing, and no supported local password reset method is documented in the provided material, this should be treated as a Microsoft engineering/support request after attempting secure‑channel repair from another machine if possible.

References: