STATUS_TRUST_FAILURE 0XC0000190 – Fix network logon failed

When you see this error

You try to log into a domain-joined Windows 10 or 11 machine at 8 AM. You type your domain password. Instead of getting to your desktop, you get a pop-up: "The trust relationship between this workstation and the primary domain failed." The exact error code in the event log is 0XC0000190, and the message says STATUS_TRUST_FAILURE.

This usually happens after a few things:

• The machine's password (yes, computers have passwords too) got out of sync with the domain controller. This can happen if the PC was offline for a while—like a laptop someone took on vacation.
• Someone reset the computer account in Active Directory from another machine.
• You restored the PC from a backup that had a different machine password.

What's actually happening

Every domain-joined computer has a secret password it shares with the domain controller. This password changes automatically every 30 days by default. When the computer's password doesn't match what the DC expects, Windows can't authenticate the machine. Without that, it won't let you log in with domain credentials.

The fix is straightforward: you reset the machine account password. You can do this remotely from another domain-joined PC using Netdom or PowerShell. No need to unjoin and rejoin the domain—that's a last resort.

Fix it step-by-step

Prerequisites

You need a different domain-joined computer (or a server) where you can log in with domain admin rights. You'll need to know the name of the broken computer and the domain admin credentials.

Option 1: Using Netdom (quickest)

1. Log into a working domain-joined PC with a domain admin account.
2. Open Command Prompt as Administrator. Press Win+R, type cmd, then right-click and choose Run as administrator.
3. Type this command, replacing BROKEN-PC with the actual computer name and YOURDOMAIN with your domain name:

   netdom resetpwd /s:YOURDOMAIN-DC /ud:YOURDOMAIN\Administrator /pd:*

   Here, YOURDOMAIN-DC is the name of any domain controller. You can get this by running nltest /dsgetdc:YOURDOMAIN from a working PC.
4. Press Enter. It will ask for the password of the domain admin account you specified. Type it and press Enter.
5. Wait. You should see: "The machine account password for BROKEN-PC has been reset successfully."
6. Go back to the broken PC, restart it, and try logging in with your domain credentials.

Option 2: Using PowerShell (if Netdom isn't available)

1. On a working domain-joined PC, open PowerShell as Administrator.
2. Run this command:

   Reset-ComputerMachinePassword -Server YOURDOMAIN-DC.YOURDOMAIN.local -Credential YOURDOMAIN\Administrator

3. It will prompt for the admin password. Enter it.
4. If it succeeds, you won't see any output—just a new prompt. That's normal.
5. Restart the broken computer and test login.

Option 3: If you can't get to another PC

If you only have the broken PC and no other domain-joined machine handy, you can still fix it, but you'll need the local administrator password.

1. On the broken PC, log in as local administrator. The account name is often .\Administrator. If you don't know the password, you'll need to reset it using a bootable password reset tool or by booting into Safe Mode.
2. Once logged in locally, open Command Prompt as Administrator.
3. Disconnect the network cable or turn off Wi-Fi (so the PC doesn't try to authenticate to the domain).
4. Run:

   netdom resetpwd /s:YOURDOMAIN-DC /ud:YOURDOMAIN\Administrator /pd:*

   This command works even if the PC can't authenticate—it sends the reset request directly to the DC.
5. Type the domain admin password when prompted.
6. Reconnect the network, restart, and try domain login again.

What if it still fails?

If the reset command fails with "The network path was not found", the broken PC can't reach the domain controller. Check these:

• Run ping YOURDOMAIN-DC from the broken PC. If it fails, you have a DNS or network issue.
• Verify the client's DNS is pointing to the domain controller. Run ipconfig /all and check the DNS server IP.
• If you're using a DHCP reservation or static IP, make sure the DNS server address is correct.
• Temporarily disable the firewall on the broken PC to rule out blocking. Re-enable it after testing.

If the reset command succeeds but login still fails, the problem might be deeper—like a corrupted Local Security Authority (LSA) cache. In that case, the nuclear option is to unjoin and rejoin the domain. Back up any user profiles first (they'll be orphaned).

To unjoin:

1. Log in as local admin.
2. Go to Settings > Accounts > Access work or school.
3. Select the domain account and click Disconnect.
4. Restart, then rejoin the domain normally.

That's the worst-case scenario, and it's rare if the reset command works. Nine times out of ten, the netdom resetpwd command gets you back in business in under five minutes.