Windows error 1787 (ERROR_NO_TRUST_SAM

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The domain security database has no computer account matching the workstation trust relationship.

Previous	Next
ERROR_NO_TRUST_LSA_SECRET	ERROR_TRUSTED_DOMAIN_FAILURE

ERROR_NO_TRUST_SAM_ACCOUNT

The workstation computer account is missing from the domain.

ERROR_NO_TRUST_SAM_ACCOUNT is Win32 error 1787 (0x6FB). During domain authentication, the selected domain controller could not find the server-side computer account needed for this workstation’s trust. The local machine may still believe it is joined. This mismatch can follow accidental deletion, replication delay, restore, rename, reuse of a computer name, or contact with an unexpected domain.

Frequent causes

the computer object was deleted, disabled, moved improperly, or recreated with a new identity
Active Directory replication has not delivered the account to the contacted domain controller
DNS directs the workstation to the wrong domain or stale domain controller
a snapshot rollback restored local join state after administrators removed the account
automated provisioning reused a hostname while the old and new machine identities diverged

Directory and client evidence

Capture workstation name and domain, object GUID and SID when available, account enabled state, last password-set time, domain controller used, site, replication status, DNS records, Netlogon events, machine provisioning history, and secure-channel test results. Avoid resetting multiple similarly named objects until identity is confirmed.

How to investigate

Locate the exact computer account in Active Directory and verify its identity, enabled state, and expected organizational unit. Query more than one domain controller when replication is suspect. Confirm that the workstation is contacting the intended forest and that its primary DNS configuration points to authoritative domain DNS.

Compare local join information with the directory object. If an account was recently restored or recreated, determine whether the machine password and object identity still match. Check for duplicate DNS or hostname use before repairing the channel.

Recovery

Restore or recreate the correct computer account through approved provisioning and repair the secure channel, or rejoin the workstation when identity cannot be reconciled. Perform the action against the intended domain controller and allow replication to complete before declaring failure.

Asset automation should use unique stable machine identities, monitor accidental object deletion, and serialize rename/rejoin operations. Do not repeatedly delete and recreate the object as a first diagnostic step because that discards evidence and can affect services tied to the account.

Difference from a local-secret problem

ERROR_NO_TRUST_SAM_ACCOUNT identifies missing server-side account state. Error 1786 identifies missing local LSA secret. Error 1789 usually means both sides exist but the workstation secure channel cannot authenticate successfully.

Example

A computer object is deleted during organizational-unit cleanup while the laptop is offline. On return, the laptop reports 1787. Directory audit confirms deletion; administrators restore the object and repair the secure channel instead of troubleshooting the user account.

References

Looking for a different code? Search another status or error code.