'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix 'File Already Exists' Error When Creating a Two-Way Trust Between Domain Controllers
Question details
The user needs to establish a two-way trust relationship between two primary domain controllers but is blocked by a file existence error.
- Product
- Windows Server Active Directory
- Device & OS
- not provided
- Scenario
- Attempting to create a two-way trust relationship between two distinct Active Directory domains to allow cross-domain resource access.
- Observed behavior
- The setup process fails, displaying an error message that indicates 'the file already exists', preventing the trust from being successfully created.
Ensure you have Enterprise Admin or Domain Admin privileges in both domains, and always create a system state backup of your Active Directory before making structural changes.
Clear Stale Active Directory Trust Objects
Use this solution to remove remnants of previous, failed, or improperly removed trust relationships that trigger the 'file already exists' conflict.
When a trust relationship is deleted improperly or a previous setup attempt fails, hidden Trusted Domain Objects (TDOs) can be left behind in the Active Directory System partition. These remnants conflict with new trust configurations.
Log into your Primary Domain Controller, open 'Active Directory Domains and Trusts' from the Administrative Tools, and check if any broken trust relationships are currently listed. If they are, right-click and remove them.
If no trust is visible in the GUI, open 'ADSI Edit' (adsiedit.msc). Connect to the 'Default naming context' and expand your domain.
Navigate to 'CN=System'. Look for objects of type 'trustedDomain' that match the name of the domain you are trying to trust.
Carefully delete these orphaned 'trustedDomain' objects. Repeat this process on the Primary Domain Controller of the other domain, then restart the Netlogon service on both servers.
Verify DNS Resolution and Connectivity
Ensure that both domain controllers can properly locate and communicate with each other over the network before attempting to establish a trust.
Document Your Server Configurations with WPS Office
While resolving Active Directory trust issues requires native Windows Server tools, IT professionals need a reliable suite for maintaining system documentation, network diagrams, and server logs. WPS Office offers a lightweight, robust, and free alternative to standard office software.
Frequently Asked Questions
Which firewall ports must be open to establish a two-way domain trust?
To successfully establish and maintain a domain trust, you must allow traffic over DNS (TCP/UDP 53), Kerberos (TCP/UDP 88), RPC Endpoint Mapper (TCP 135), RPC Dynamic Ports (TCP 49152-65535), LDAP (TCP/UDP 389), and SMB (TCP 445) between both domain controllers.
Why does the system say a trust file already exists when I cannot see one in the GUI?
This typically occurs if a previous trust was forcefully or improperly removed. The graphical interface may no longer display the trust, but the underlying Trusted Domain Object (TDO) still exists hidden within the Active Directory 'System' container.
Can I create a two-way trust if the domain controllers cannot ping each other by name?
No, successful DNS name resolution is a strict prerequisite for Active Directory trusts. You must configure conditional forwarders or stub zones in your DNS settings so both domains can resolve each other's Fully Qualified Domain Names (FQDN) before running the trust wizard.
