What does Windows error code 1788 (ERROR_TRUSTED_DOMAIN_FAILURE) mean?

 
Previous Next
ERROR_NO_TRUST_SAM_ACCOUNT ERROR_TRUSTED_RELATIONSHIP_FAILURE

ERROR_TRUSTED_DOMAIN_FAILURE

The trust relationship between the primary and trusted domains failed.

ERROR_TRUSTED_DOMAIN_FAILURE is Win32 error 1788 (0x6FC). It concerns a domain-to-domain trust path: the primary domain could not successfully use its trust relationship with another trusted domain while processing authentication or authorization. The user account may be valid in its home domain, and the workstation’s own machine trust may be healthy, yet cross-domain access still fails.

Conditions that break interdomain trust

  • trust passwords or trust objects are inconsistent between the two domains
  • DNS, routing, firewall, or time synchronization prevents domain controllers from communicating
  • the trust is disabled, quarantined, misdirected, or configured with incompatible direction
  • forest or domain migration left stale names, SIDs, or selective-authentication settings
  • replication has not converged after trust creation, reset, or domain-controller restore

Cross-domain evidence to collect

Record source, account, primary, target, and trusted domain names and SIDs; trust type and direction; domain controllers contacted on each side; DNS and site information; time offset; Netlogon and Kerberos events; trust verification results; selective-authentication policy; and the resource being accessed. Redact account identifiers in broadly accessible telemetry.

Diagnostic order

Establish whether same-domain authentication works, then verify name resolution and network reachability between domain controllers. Inspect the trust object and direction from both domains. A one-way trust tested in the wrong direction is a configuration error, not a password reset problem.

Correlate failures on both sides and verify replication before resetting anything. Check SID filtering, selective authentication, and migration history when only specific users or resources fail. Use supported trust validation tools under domain-administrator change control.

Resolution and containment

Correct DNS, network, time, replication, or trust configuration and validate from both domains. Reset or recreate the trust only after confirming ownership, direction, and impact. Preserve emergency local or same-domain administrative access before changing a production trust.

Monitoring should distinguish interdomain trust health from workstation secure-channel health. Alert on repeated 1788 results grouped by domain pair and domain controller, not as isolated user password failures.

Difference from workstation trust failure

ERROR_TRUSTED_DOMAIN_FAILURE concerns trust between domains. ERROR_TRUSTED_RELATIONSHIP_FAILURE concerns the workstation and its primary domain. ERROR_TRUST_FAILURE is a broader network-logon trust failure and needs surrounding context.

Example

Users in Domain B suddenly cannot access a file service in Domain A, while local logon and same-domain resources work. Events on both sides show 1788 after a firewall change blocked domain-controller RPC. Restoring the required path repairs the existing trust without recreating user accounts.

References

Looking for a different code? Search another status or error code.