Windows Server / Active Directory & Group Policy
Test a member server's secure channel before repairing it
A domain trust symptom can come from DNS, time or a machine-account mismatch. A non-repairing secure-channel test provides a focused first check.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Test-ComputerSecureChannel -VerboseRead the result
Run PowerShell on the affected domain member server. A failure needs follow-up evidence; this cmdlet is not an appropriate health test for a domain controller.
Resolve and verify
Check the member's DNS and clock, recent restore or clone history and machine-account state. Use the approved targeted repair only after identifying the correct computer identity.
Before changing production
Do not unjoin and rejoin production servers casually. The repair path can affect services, profiles and managed identities.