Disjoint namespace scenario, "The security database on the server does not have a computer account for this workstation trust relationship" error after computer move (4259917)

Disjoint namespace scenario, "The security database on the server does not have a computer account for this workstation trust relationship" error after computer move

Disjoint namespace is configured in source AD, i.e. computers have FQDN names that are different from Active Directory domain name. Such machine is moved with Resource Updating Manager to target domain and user is unable to logon anymore. The error is "The security database on the server does not have a computer account for this workstation trust relationship".

This can be caused by configuration of the target domain as by default AD will not allow the machines to update their hostnames if disjoint namespace is in use.

Add disjoint namespace suffix to target AD to attribute msDS-AllowedDNSSuffixes attribute using the procedure from the following TechNet article:
https://technet.microsoft.com/en-us/library/cc731929(v=ws.10).aspx


To add the additional primary DNS suffixes to the list of allowed suffixes in AD DS

1.    On any domain controller in the Active Directory domain, click Start, click Run, type adsiedit.msc, and then press ENTER.
2.    Expand the domain naming context (NC) to expose the directory partition that relates to the Active Directory domain for which you want to allow a disjoint namespace.
3.    Right-click the Active Directory domain partition, and then click Properties.
For example, DC=fabrikam,DC=com is the domain partition for Fabrikam.com.
4.    In Attributes, click the msDS-AllowedDNSSuffixes attribute, and then click Edit.
5.    In Value to add, type the name of a primary DNS suffix that you want to allow.
For example, type na.corp.fabrikam.com if you have computers that will use that primary DNS suffix, and then click Add. To configure multiple DNS suffixes, repeat this step for each DNS suffix.
6.    When you have entered all the additional DNS suffixes that you want to allow, click OK twice to confirm your changes.
7.    Close ADSI Edit.