Last updated: 11 November 2026

An issue that can be particularly disruptive in non-persistent Citrix environments.

The VDA appears to start normally after a reboot. The VM is reachable and the network connection is up, but users can no longer log on.

❌ Windows reports a broken domain trust relationship
❌ User logons through ICA or RDP fail
❌ A restart does not permanently resolve the issue
❌ In the worst case, multiple machines in an MCS catalog are affected

🔍 What is the actual cause?

With Citrix Machine Creation Services (MCS), each machine receives its own identity.

This is supplied through components including the MCS Identity Disk.

It contains the machine-specific identity information required for the correct association with the Active Directory domain.

If the machine account password or trust information no longer matches the AD computer account, the domain trust relationship may fail.

Possible triggers include snapshot rollbacks, incorrect identity information or manual changes to AD computer accounts.

🛠️ My troubleshooting approach

First, I check the secure channel on the affected VDA:

Next, I check:

✔️ Netlogon events
✔️ The associated AD computer account
✔️ The MCS Identity Disk assignment
✔️ Machine status in the Citrix Broker

And here is the interesting part:

Citrix provides Repair-AcctIdentity for targeted repair of the machine identity.

It can repair the machine password and trust information without immediately rebuilding the entire machine catalog.

Example:

Important: the affected VM must be powered off and in maintenance mode.

💡 My takeaway

For a broken secure channel in a non-persistent MCS environment, I would not simply remove the computer from the domain and join it again.

MCS manages the machine identity. A manual repair inside the VDA may therefore be lost at the next restart.

Check the MCS identity first, then perform a targeted repair instead of immediately rebuilding the entire catalog.