Active Directory Forest Trust is established between on-prem AD and Entra ID Domain Services (Domain Controller PaaS) but is not functional.

Question

Active Directory Forest Trust is established between on-prem AD and Entra ID Domain Services (Domain Controller PaaS) but is not functional.

Gareth Johnson 0

The statement in bold relates to use and I believe it is related to:

https://learn.microsoft.com/en-us/answers/questions/92016/domain-controller-allow-vulnerable-netlogon-secure?page=1#answers

The session setup from computer 'XMIPZGK5ES3LZ32' failed because the security database does not contain a trust account 'testdomain.cloud.' referenced by the specified computer.

USER ACTION

If this is the first occurrence of this event for the specified computer and account, this may be a transient issue that doesn't require any action at this time. If this is a Read-Only Domain Controller and 'testdomain.cloud.' is a legitimate machine account for the computer 'XMIPZGK5ES3LZ32' then 'XMIPZGK5ES3LZ32' should be marked cacheable for this location if appropriate or otherwise ensure connectivity to a domain controller capable of servicing the request (for example a writable domain controller). Otherwise, the following steps may be taken to resolve this problem:

If 'testdomain.cloud.' is a legitimate machine account for the computer 'XMIPZGK5ES3LZ32', then 'XMIPZGK5ES3LZ32' should be rejoined to the domain.

If 'testdomain.cloud.' is a legitimate interdomain trust account, then the trust should be recreated.

Otherwise, assuming that 'closebrothers.cloud.' is not a legitimate account, the following action should be taken on 'XMIPZGK5ES3LZ32':

If 'XMIPZGK5ES3LZ32' is a Domain Controller, then the trust associated with 'closebrothers.cloud.' should be deleted.

If 'XMIPZGK5ES3LZ32' is not a Domain Controller, it should be disjoined from the domain.

3 answers

Your answer

Answer 1

Marcin Policht 38,555 MVP

Verify that the requirements for the trust are in place. Start with https://docs.azure.cn/en-us/entra/identity/domain-services/concepts-forest-trust#forest-trust-requirements

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Gareth Johnson 0 Reputation points

2025-03-03T13:21:57.72+00:00

Hi Marcin,

Have confirmed DNS is working as expected in both directions. All firewall rules match as per the article and not seeing any blocks. Have tried recreating the trust with the same errors within the event log.

Answer 2

Raja Pothuraju 16,580 Microsoft External Staff

Hello @Gareth Johnson,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it seems that the trust relationship between your on-premises Active Directory and Entra ID Domain Services is not properly established. The error message indicates that the session setup from a specific computer failed because the security database does not contain a trust account referenced by that computer.

To troubleshoot this, please refer to the following document for guidance on creating and verifying trust relationships between on-premises Active Directory and Entra ID Domain Services: Create and Verify Forest Trust.

Additionally, could you please share the configuration steps you followed and the values you entered in the configuration options? This will help us analyze any potential misconfigurations.

Also, ensure that your managed domain is using at least the Enterprise SKU, as it is required for establishing trust relationships. If needed, change the SKU for a managed domain.

If you prefer not to share your configuration publicly, you can also send it via a private message. This will help us troubleshoot the issue while maintaining confidentiality.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Gareth Johnson 0 Reputation points

2025-03-03T13:54:24.8433333+00:00

Hi Raja, I can confirm this is exactly the document we referenced and that we are using the enterprise sku. We are using a one-way outgoing trust, the only relationship that isn't in preview. Event IDs are 5805, 5828 and 5723, all NETLOGON related.
Raja Pothuraju 16,580 Reputation points Microsoft External Staff

2025-03-03T16:46:34.3166667+00:00
Hello @Gareth Johnson,Thank you for your response and for sharing the event IDs.

Event ID 5828 is logged when a vulnerable Netlogon secure channel connection from a trust account is denied.

By default, supported and fully updated versions of Windows should not be using vulnerable Netlogon secure channel connections. If you see Event ID 5828 in the system event log for a Windows device, please check the following:

Confirm that the device is running a supported version of Windows.

Ensure the device is fully updated via Windows Update.

Verify that "Domain member: Digitally encrypt or sign secure channel data (always)" is set to Enabled in a Group Policy Object (GPO) linked to the OU containing your domain controllers (e.g., the default domain controllers GPO).

For more details, refer to the official documentation: How to Manage Changes in Netlogon Secure Channel Connections

Event ID 5723 occurs when a client loses its secure channel connection with the domain controller. You can follow the steps outlined in this document to resolve it: Secure Channel Problems Detected – Resolution

For further troubleshooting from my end, please share your Microsoft Entra Domain Name details via private message.
Raja Pothuraju 16,580 Reputation points Microsoft External Staff

2025-03-05T01:14:03.6233333+00:00

Hello @Gareth Johnson,

Just checking in to see if below information was helpful and please share your Microsoft Entra Domain Name details via private message for further troubleshooting.
Raja Pothuraju 16,580 Reputation points Microsoft External Staff

2025-03-05T20:50:58.3766667+00:00

Hello @Gareth Johnson,

Just checking in to see if below information was helpful and please share your Microsoft Entra Domain Name details via private message for further troubleshooting.

Answer 3

Hello @Gareth Johnson,

After conducting research on your issue and consulting with our Product Group team, it appears that your on-premises domain controllers are logging the following events in the Event Viewer:

The Netlogon service denied a vulnerable Netlogon secure channel connection using a trust account.

Account Type: Trust

Trust Name: Contoso.com

Trust Target: Contoso.net

Client IP Address:

================================================================

The session setup from computer 'XMIPZGK5ES3LZ32' failed because the security database does not contain a trust account 'testdomain.cloud.' referenced by the specified computer.

Root cause:

If your Microsoft Entra Domain Name is Domain.com and your AD DS Domain Name is Domain.net, the issue occurs because both domains share the same NetBIOS name ("Domain"). A trust cannot be established between two domains with identical NetBIOS names.

Either we change the domain name in local directory, or we change the Microsoft Entra Domain Service domain name.

Tutorial - Create a Microsoft Entra Domain Services managed domain

To resolve this, ensure that NetBIOS, Legacy Domain, or DNS Domain names are not duplicated across environments.

The recommend approach is to Recreate your Microsoft Entra Domain Services (Entra DS) following the official documentation to avoid naming conflicts.

Tutorial - Create a Microsoft Entra Domain Services managed domain

Share via

Active Directory Forest Trust is established between on-prem AD and Entra ID Domain Services (Domain Controller PaaS) but is not functional.

3 answers

Your answer