Fix Domain Trust Inconsistent Error 0X00000712

What You're Dealing With

You're seeing error 0X00000712. It means the domain controller can't agree on who it trusts. The SID (security identifier) or domain name in the trust object doesn't match what the other DC thinks. Happens a lot after you restore a backup of a DC, or if someone renames a domain and doesn't update trusts. I've seen it after a failed domain rename, or when you clone a DC without proper preparation. The machine basically says "you're not the domain I thought you were."

Quick Fix (30 seconds) - Check the Trust Object

Don't start tearing down trusts yet. First, verify that the trust still exists and hasn't been corrupted. Open a command prompt as admin on a DC (not the one you suspect is broken). Run this:

nltest /domain_trusts /all_trusts

Look for the trust in question. If you see a trust listed but the status says "broken" or "inconsistent", you're in the right place. Also check if the trust shows the right domain name. I've seen cases where a trust accidentally points to an old domain that got merged. If everything looks normal, move to the moderate fix.

Moderate Fix (5 minutes) - Verify SID and Name Consistency

The culprit here is almost always a SID mismatch. Each domain has a unique SID. If two DCs think the same domain has different SIDs, the trust breaks. Run this on every DC in the trust:

wmic path Win32_ComputerSystem get Domain, DomainRole, PartOfDomain

Also check the SID:

whoami /user

Compare the SIDs across DCs. They should match for the same domain. If one DC shows a different SID than the other, that's your problem. You need to get the SID back in sync. Run this to see the trust's SID:

nltest /trusted_domains

If you find a SID mismatch, the fastest way is to delete and recreate the trust. Yes, it's painful, but I've spent hours trying to patch it and gave up. Do it clean. On both sides (if it's a two-way trust), remove the trust using Active Directory Domains and Trusts snap-in. Then re-add it. Make sure to enter correct credentials. Test with nltest after.

Advanced Fix (15+ minutes) - Reset the Computer Account

If the trust itself looks clean but the error persists, the problem might be the computer account of the DC or member server. A trust relationship works partly through the computer's password in AD. If that's out of sync, you get 0X00000712. Open ADUC, find the computer object. Right-click, Reset Account. Then restart the machine. After reboot, rejoin it to the domain (you might need to unjoin and rejoin, but I prefer reset first).

But don't blindly reset everything. First, check the current state of the computer account password:

nltest /sc_query:domain.local

If it says trust failed, reset it. Then run:

netdom resetpwd /server:dc.domain.local /userd:domain\admin /passwordd:*

Enter the password when prompted. This forces the secure channel to renegotiate. I've used this on Windows Server 2012 R2, 2016, 2019, and 2022 — works every time when the password got stale.

Check for Cloned DCs

If someone cloned a DC without using the proper virtualization safeguards (like generating a new machine ID), you'll get trust issues. Check if the DC reports the same SID as another DC. Use repadmin to see replication status:

repadmin /replsummary

If you see a lot of "access denied" or "trust relationship" errors, you probably have duplicate SIDs. You'll need to demote one of the cloned DCs, promote a fresh one, and re-establish trusts. Not fun, but necessary.

Final Check

After any change, verify the trust works. Use this heavy hitter:

nltest /dsgetdc:domain.local

It should return a DC list. If it fails, you're not done yet. Go back to the moderate fix and redo it carefully. Also, check DNS. Bad DNS can mimic trust errors. Make sure all DCs can resolve each other's fully qualified domain names. Run:

nslookup dc.local.domain

If DNS is flaky, fix that first — trust can't work without it.

When to Call Microsoft

If you've gone through all these steps and still see 0X00000712, there's likely a deeper database corruption. Check the System event log for NTDS errors. If you see 1925 or 1908, you might need to restore from backup or escalate. But honestly, 9 times out of 10, it's a simple SID or password issue. Start with the quick fix, end with the advanced. You'll get it.