Windows error 1786 (ERROR_NO_TRUST_LSA

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The workstation lacks the local LSA secret required for its domain trust secure channel.

Previous	Next
ERROR_UNRECOGNIZED_MEDIA	ERROR_NO_TRUST_SAM_ACCOUNT

ERROR_NO_TRUST_LSA_SECRET

The local machine trust secret is missing.

ERROR_NO_TRUST_LSA_SECRET is Win32 error 1786 (0x6FA). A domain-joined computer maintains local security-authority state used with its machine account to establish a Netlogon secure channel. This code means the workstation cannot find the required local trust secret. It points to missing or damaged local domain-join state, not merely a user typing the wrong password.

How the local secret can be lost

a system image or registry hive was restored without matching domain-join security state
unsupported cleanup or cloning removed local LSA trust data
disk or registry corruption damaged security-account information
an incomplete join, rename, or migration left inconsistent local configuration
security tooling deleted or isolated protected state while remediating the machine

Evidence to collect before repair

Record computer name, domain and forest, local time and time source, domain controller selected, machine account distinguished name, operating-system build, restore or cloning history, Netlogon and LSA events, secure-channel tests, and whether local administrator access remains available. Never attempt to dump or log the secret itself.

Diagnostic sequence

Verify that the computer is intended to remain joined to the named domain and that DNS resolves domain controllers correctly. Check local domain membership and the corresponding Active Directory computer object. Compare this result with ERROR_NO_TRUST_SAM_ACCOUNT: 1786 concerns the local secret, while 1787 concerns the server-side computer account.

Inspect recent backup restore, snapshot rollback, identity cloning, and registry-repair activity. Run supported secure-channel diagnostics from a local administrative session. If local trust state is absent, repeated network logon attempts will not recreate it automatically.

Supported recovery

Use an approved secure-channel repair or remove and rejoin the computer to the domain when repair is not possible. Coordinate with administrators so the correct computer account is reset rather than creating duplicates. Preserve local profiles, encryption recovery information, and service-account dependencies before rejoining.

Imaging systems should generalize domain identity and join each clone independently. Backup procedures must document whether system-state restoration rolls machine trust backward relative to Active Directory.

Difference from a missing server account

ERROR_NO_TRUST_LSA_SECRET means required trust material is missing locally. ERROR_NO_TRUST_SAM_ACCOUNT means the domain security database has no matching computer account. A generic trust failure can occur even when both objects exist but their passwords differ.

Example

A domain-joined workstation is restored from an incomplete image containing user files but not consistent local security state. Logon returns 1786. Administrators preserve recovery keys and profiles, then rejoin the machine using the existing approved computer identity.

References

Looking for a different code? Search another status or error code.