Trust relationship auto fix script - powershell

Question

i am trying to come up with a script to automate the fix for the common issue in domain environment "the trust relationship error " for my help-desk employee , where they can just run the script with required variable
options : using power-shell or PsExec and should accept user input for naive user .
looking at powershell a simple line may fix the issue after google research : " Test-COmputerSecureChannel -Repair " which does not require reboot as well
challenges in powershell per my simple knowledge ( remote command execution should be enabled in remote machine which is not an option
> PsExec not available by default windows 7 / citrix employee
computer name : SAWD456335355 ( should be variable - user input )
local admin : Administrator
local password: variable differ from computer to computer ( should be user input as well accept special character )
=================================
Privilege admin level 1 account for pop up
while trying to change the local computer using team viewer a pop up will ask for domain credentials for instance :
user name would be sth like : admingroup1
password for privlege admin : password#123 < for example

Answer 1

There are three ways you could fix this.
What you are actually asking for, repair the secure channel. You will most likely need a local admin account (local because the trust relationship is broken) and a combination of Psexec and PowerShell remoting.
<# Get Help desk operator input#>
$Computer = Read-Host "Enter Computer name"
$AdminAccount = Read-Host "Enter local Admin Account"
$SecurePassword = Read-Host "Enter local Admin Password" -AsSecureString
<# Create Plain text password object and Credential Object#>
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecurePassword)
$UnsecurePassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $AdminAccount, $SecurePassword
<#Enable PS Remoting#>
Psexec.exe \$Computer -u $AdminAccount -p $UnsecurePassword -h -d powershell.exe "enable-psremoting -force"
<# Repair secure Channel#>
Invoke-Command -ComputerName $Computer -Credential $Credential -ScriptBlock {
Test-ComputerSecureChannel -Repair
}
Set the domain to NOT reset domain computer accounts. This is probably not recommended in most environments.
In my environment I found the best solution was to prevent automatic system restore (probably after a power outage or similar) that is older than the computer password as discussed here:
https://support.microsoft.com/en-us/kb/295049
My solution was to run a scheduled task to delete system restore points that are older than the current computer password.
Get-ComputerRestorePoint |`
Where {$_.ConvertToDateTime($_.CreationTime) -lt $PasswordLastSet} | `
Delete-ComputerRestorePoints
If no system restore points are left the script creates a new one.
A detailed write up can be found here:
http://blog.buktenica.com/issues-with-domain-membership-after-system-restore/