| Previous | Next |
| RPC_S_NO_MORE_BINDINGS | ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT |
ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
An interdomain trust account cannot be used for this ordinary logon.
ERROR_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT is Win32 error 1807 (0x70F). Active Directory contains special accounts used to represent trust relationships between domains. Those accounts are infrastructure identities, not normal user or service principals for interactive or network resource logon. The error indicates that authentication selected an interdomain trust account where a global user or local account was required.
How the wrong account type is selected
- a script or application supplies the name of a trust account instead of a user account
- migration creates a naming collision between an intended service identity and a trust object
- credential storage contains an obsolete domain-qualified account name
- custom authentication code searches directory objects without filtering account type
- an administrator attempts to repurpose a trust account for a scheduled task or service
Identity evidence to record
Capture the submitted domain and account name, account SID and type, directory object class, userAccountControl flags, logon type, target resource, domain controller, authentication package, and configuration source that selected the credential. Never log the password or trust secret. Restrict SID and domain details when telemetry crosses tenant boundaries.
Troubleshooting steps
Resolve the submitted identity in the intended domain and inspect its account type rather than relying on the name. Confirm whether the object represents an interdomain trust and whether a similarly named user or service account exists elsewhere. Review the application’s domain qualification and directory search filters.
Check recent trust migration, rename, and credential-rotation changes. If the account came from stored configuration, identify who provisioned it and why. Do not reset the trust account password merely to make an application logon succeed; that can damage domain trust.
Corrective action
Configure the application, service, or user session with an approved global user, local account, managed service account, or other supported identity. Leave the interdomain trust account dedicated to trust maintenance. Validate least privilege and rotate any incorrectly stored credentials.
Provisioning systems should filter directory principals by supported account class and reject infrastructure trust accounts before deployment. Error messages should say that the account type is invalid without exposing trust internals to unauthenticated users.
Difference from workstation trust accounts
ERROR_NOLOGON_WORKSTATION_TRUST_ACCOUNT concerns a computer account used for ordinary logon. Error 1807 concerns an interdomain trust account. Both differ from a broken trust relationship: the infrastructure account may be healthy but inappropriate for the requested logon type.
Example
A service configuration mistakenly uses a domain trust object name copied from an audit report. Authentication returns 1807. Administrators create a managed service account with only the required permissions and leave the domain trust credentials untouched.
References
Looking for a different code? Search another status or error code.