Purposefully break trust relationship with Windows Domain

Question

For testing purposes I am trying to purposefully break trust relationships with the Windows Domain. What is the quickest way to kill it off? "Unfortunately", broken trust relationships don't regularly occur with my set up so I'd like a way to artificially break one.

If possible, I'd like to be able to trigger this from both the server and client side.

Using Windows Server 2016 Core and Windows 7/8.1 clients.

score 9 · Answer 1 · answered Apr 23 '17 at 21:53

9

Right click the computer object in Active Directory Users and Computers... select Reset Account. This will break the trust between the computer account and the domain.

You can use Powershell, netdom, or nltest to recreate/fix the trust.

answered Apr 23 '17 at 21:53

joeqwerty

108,377
6
80
171

1

This is actually one of the first things I tried but the workstation just booted and logged on fine... – Pylsa Apr 24 '17 at 12:28

score 6 · Answer 2 · answered Apr 23 '17 at 20:50

6

Take snapshot of workstation.
Initiate a machine account password change (netdom /resetpdwd) Do it twice for good measure.
Restore the workstation from the snapshot.
Password stored on workstation no longer matches what's stored in Active Directory. Domain relationship busted.

answered Apr 23 '17 at 20:50

Ryan Ries

55,011
9
138
197

Any way to do it on physical workstations? These aren't VMs. – Pylsa Apr 23 '17 at 20:53
Disk clone to a image (also known as backup) @BloodPhilia – masterX244 Apr 24 '17 at 08:24

score 0 · Answer 3 · answered Jul 27 '22 at 01:30

I was able to do this in PowerShell:

On the client machine:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Type DWord -Value 0

On the DC:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Type DWord -Value 0
$dn = $(Get-ADComputer 'NAME-OF-CLIENT-SERVER').distinguishedName
dsmod computer $dn -reset

score -2 · Answer 4 · answered Aug 07 '17 at 14:51

-2

Create a a System Restore Point from system properties, do the password reset as explained, then revert to the SRP (Start-Run: rstrui).

answered Aug 07 '17 at 14:51

Julian Blue

1

Purposefully break trust relationship with Windows Domain

4 Answers4