| Previous | Next |
| ERROR_NOLOGON_SERVER_TRUST_ACCOUNT | ERROR_SERVER_HAS_OPEN_HANDLES |
ERROR_DOMAIN_TRUST_INCONSISTENT
The domain identity is inconsistent with the configured trust relationship.
ERROR_DOMAIN_TRUST_INCONSISTENT is Win32 error 1810 (0x712). A domain trust is identified by more than a display name: Windows also tracks security identifiers, trust direction, type, attributes, partner names, and secrets. The code indicates that the domain presented by discovery or authentication does not agree with the trust metadata that the local domain expects.
Typical sources of inconsistency
- a domain was rebuilt with the same DNS or NetBIOS name but a different domain SID
- trust objects differ between the two sides because creation, removal, or repair completed only partially
- stale directory replication leaves controllers with different trusted-domain information
- an incorrect DNS suffix, short name, or manually selected domain refers to a different security boundary
- a restored snapshot or unsupported directory rollback reintroduces obsolete trust state
Trust data worth collecting
Capture the local domain, claimed partner DNS and NetBIOS names, domain SID values, trust direction and attributes, domain controller used on each side, replication state, timestamps of trust changes, and Netlogon or LSA errors. Record identifiers in protected administrative diagnostics; do not log trust passwords or authentication material. Compare data from more than one controller so a single stale replica does not define the diagnosis.
How to confirm the mismatch
Resolve the partner through authoritative DNS and use supported domain-trust enumeration tools or APIs to compare names, SIDs, direction, and transitivity from both sides. Check Active Directory replication before recreating anything. If only one controller reports the conflict, repair replication and allow convergence before changing the trust.
Establish whether a domain was renamed, rebuilt, restored, or migrated. A domain with the same visible name but a new SID is a different security principal namespace. Review dependent services, SID filtering, selective authentication, and name suffix routing before replacing the trust.
Recovery strategy
Correct DNS and replication faults first. If the trust objects are genuinely inconsistent, remove and recreate or reset the trust using supported administrative tools on both sides, during a controlled window. Validate authentication in both directions and from multiple sites afterward.
Avoid editing trusted-domain objects or secrets directly. Automation should compare immutable domain identity as well as names, and it should stop when the two sides disagree rather than repeatedly rotating credentials against the wrong partner.
Difference from an unreachable domain controller
ERROR_DOMAIN_CONTROLLER_NOT_FOUND means discovery could not locate a suitable controller. Error 1810 can occur even when controllers are reachable: the identity they report conflicts with the stored trust relationship.
Example
After a lab domain is rebuilt using its old DNS name, a production trust test reaches the new controller but receives 1810 because its domain SID differs from the trusted-domain object. Recreating the authorized lab trust and reviewing SID filtering resolves the identity mismatch; changing DNS alone cannot make the rebuilt domain the original domain.
References
Looking for a different code? Search another status or error code.