How to fix Error 1353 on Windows 11

by

Troubleshooting Guide: Error 1353 – “The Domain Was in the Wrong State to Perform the Security Operation”

Why This Error Happens

Error 1353 typically occurs when there is a broken trust relationship between a domain controller and a member server or client machine, often due to a corrupted Secure Channel (SC) or mismatched security identifiers (SIDs). This can also result from replication failures between domain controllers, an expired computer account password, or corrupted Active Directory database files (NTDS.dit). In Windows 11 environments, this is frequently triggered when a machine’s domain trust token becomes desynchronized from Active Directory.

Step-by-Step Resolution Guide

Step 1: Verify Domain Controller Connectivity and Health

  • Open Command Prompt as Administrator and run nltest /sc_query:<YourDomainName> to check the secure channel status.
  • Run dcdiag /v on the Domain Controller to check for replication or connectivity errors.
  • Ensure DNS settings on the Windows 11 client point to the correct internal DNS server (usually the DC’s IP), checked via ipconfig /all.

Step 2: Reset the Secure Channel Trust

  • Run the following PowerShell command as Administrator to repair the trust relationship without rebooting into safe mode: Test-ComputerSecureChannel -Repair -Credential (Get-Credential).
  • When prompted, enter Domain Admin credentials to authenticate the repair.
  • If the command fails, proceed to manually rejoin the domain (Step 3).

Step 3: Rejoin the Machine to the Domain

  • Navigate to Settings > System > About > Domain or workgroup (or use sysdm.cpl).
  • Temporarily switch the computer to a Workgroup (e.g., “WORKGROUP”) and restart.
  • After reboot, rejoin the computer to the original Active Directory domain using valid credentials, then restart again.

Step 4: Check and Repair Active Directory Database (Server-Side)

  • If the error persists across multiple clients, the issue lies on the Domain Controller.
  • Restart the DC in Directory Services Restore Mode (DSRM).
  • Run ntdsutil and execute the activate instance ntds followed by files and integrity to check the database for corruption.

Alternative or Verification Steps

  • Verification: After completing the steps, run nltest /sc_query:<YourDomainName> again; a “Trust Verification Status = 0x0 ERROR_SUCCESS” confirms the fix worked.
  • Alternative: If rejoining the domain fails repeatedly, delete the computer object from Active Directory Users and Computers (ADUC) on the server first, then attempt the domain join again from the Windows 11 client to force the creation of a fresh computer account.