| Previous | Next |
| STATUS_NO_TRUST_SAM_ACCOUNT | STATUS_TRUSTED_RELATIONSHIP_FAILURE |
STATUS_TRUSTED_DOMAIN_FAILURE
A cross-domain distinction
STATUS_TRUSTED_DOMAIN_FAILURE narrows the problem to a logon path involving a trusted domain. It is more specific than a generic failed sign-in because the primary domain has reached the point where it needs the trusted-domain relationship to evaluate the request, and that relationship has failed. A local account or account from the primary domain may therefore behave differently from an identity in the affected trusted domain.
Do not treat this as a client-only password error. The failure can involve trust direction, domain-controller availability, DNS records for the trusted domain, secure-channel state, realm/domain naming, or changes to the relationship that one side has not yet replicated or recognised.
How to scope the incident
- Test a primary-domain account and an affected trusted-domain account against the same target to isolate the cross-domain boundary.
- Confirm the intended trust direction, namespace and controller reachability for both domains.
- Verify DNS service discovery in both domains and collect Netlogon/Kerberos evidence on the controllers involved.
- For non-Windows domain members, verify the configured realm, keytab and DNS integration rather than assuming an existing machine join is still valid.
References
- Microsoft Open Specifications: NTSTATUS reference
- Samba Wiki: troubleshooting domain members
- SSSD: manual Active Directory join
- Microsoft Open Specifications: Kerberos Protocol Extensions (MS-KILE)
Looking for a different code? Search another status or error code.