Answer: A

Reset the secure channel Occasionally, you might need to reset the computer’s secure channel. When a computer signs in to the AD DS domain, it establishes a secure channel with the domain controller; the secure channel is sometimes referred to as a trust. Under some circumstances, this trust becomes unavailable, and the computer cannot establish the secure channel. This can result in users being unable to sign in at the computer, and in the failure of the application of GPOs on the computer. Often, when a secure channel failure has occurred, users receive the following message when they attempt to sign in: “The trust relationship between the workstation and the primary domain failed.” Some administrators remove the computer from the domain, adding it temporarily to a workgroup, and then after restarting the computer, they add it to the domain again. This is usually successful. However, this removes the computer object in AD DS and creates a new one, albeit with the same name. Because the object is new, and has a new security identity (SID), any group memberships for the computer are lost; this might not be a concern. However, if you use group memberships extensively, it is better to reset the secure channel rather than remove the computer from the domain. You can reset the channel by using Active Directory Users and Computers, Windows PowerShell, or the Dsmod.exe command-line tool. Resetting the channel ensures that the computer’s SID remains the same, and this means that group memberships are retained.

from: Exam Ref 70-742 Identity with Windows Server 2016 book