Fix domain relationship breaking after restart due to tombstone state

draft · network domaindnsactive-directory

Generated by docuprocessor (prompt article/v3) · 2026-04-22 13:09

Source thread

thread_id: spaces/AAAA05BdS6s/threads/s93wwCCh3EM · 13 msgs · first 2024-06-11 · participants: Tech ATech BTech C

Tech A 2024-06-11 12:53

Bright Smile Dental office. I have a computer that lost the relationship with the domain, i rejoined it, restarted it, and it lost the relationship again. It has the server as primary DNS. Any idea why this keeps happening?

Tech B 2024-06-11 13:02

yes, please read the thread from yesterday about that office

Tech B 2024-06-11 13:02

in a few words - the domain is fucked now and needs to be redone.

Tech A 2024-06-11 13:03

amazing, thanks for the heads up

Tech C 2024-06-11 13:43

I got one to work just now, temporarily we have to remove the DNS pointing to server DC and then if it's still not activating we can add the cred mgr

image/png Screenshot 2024-06-11 at 9.41.53 AM.png

A LogMeIn remote session is active, connected to a machine identified as **KHRAKOVSKY W5TH - ROOM-3 - Monitor 1**. The remote desktop displays a network or shared drive file explorer window containing nine folders: **APPS, Docs, DTXCommon, Images, NETLOGON, PDATA, SYSVOL, YAPI Dashboard Install, and YService**. No error codes, indicator lights, or diagnostic readouts are visible.

Tech A 2024-06-11 13:46

Does the relationship with the domain get broken after restarting?

Tech A 2024-06-11 13:46

Because I was able to Join the domain, but after 2 restarts it broke

Tech B 2024-06-11 13:46

dont restart 🙂

Tech B 2024-06-11 13:47

also, you dont have to join to the domain, you can leave it on workgroup and use the credentials manager to authenticate

Tech B 2024-06-11 13:47

in theory...

Tech B 2024-06-11 13:47

but how its gonna work with the messed up domain, I am not sure

Tech A 2024-06-11 13:47

yep, sometimes it works, sometimes its a headache,let's see

Tech C 2024-06-11 13:47

yeah the issue is since domain is tombstone state, when you are part of domain, it blocks you, but if you are in cached or offline mode and not seeing domain, it can authenticate using the usual user | pass

---
title: "Fix domain relationship breaking after restart due to tombstone state"
category: network
tags: ["domain", "dns", "active-directory"]
source_thread_id: "spaces/AAAA05BdS6s/threads/s93wwCCh3EM"
source_space: "spaces/AAAA05BdS6s"
generated_at: "2026-04-22T13:09:30"
participants: ["Tech A", "Tech B", "Tech C"]
---

# Fix domain relationship breaking after restart due to tombstone state

## Problem
A workstation at a client office repeatedly loses its domain relationship after being rejoined and restarted. The computer has the server configured as primary DNS. The domain controller is in a tombstone state, causing authentication failures when machines attempt to communicate with the domain after restart.

## Resolution
1. Remove DNS pointing to the server domain controller from the workstation's network configuration
2. Leave the workstation on workgroup instead of rejoining to the domain
3. Use Windows Credential Manager to authenticate domain users instead of domain membership
4. Avoid restarting domain-joined machines until the domain controller is rebuilt, as restarts will break the relationship again

Note: This is a temporary workaround. The domain controller requires a complete rebuild to resolve the underlying tombstone state issue.

## References
- Source discussion: `spaces/AAAA05BdS6s/threads/s93wwCCh3EM`
- Attachments: - ![Screenshot 2024-06-11 at 9.41.53 AM.png](../attachments/s93wwCCh3EM.yXRdnZ9hFTM/Screenshot 2024-06-11 at 9.41.53 AM.png) — A LogMeIn remote session is active, connected to a machine identified as **KHRAKOVSKY W5TH - ROOM-3 - Monitor 1**. The remote desktop displays a network or shared drive file explorer window containing nine folders: **APPS, Docs, DTXCommon, Images, NETLOGON, PDATA, SYSVOL, YAPI Dashboard Install, and YService**. No error codes, indicator lights, or diagnostic readouts are visible.

Generated article

draft