Add troubleshooting step for allow-group AD lookup fail

src/pages/client/profile-ownership.mdx

@@ -204,6 +204,34 @@ sudo netbird profile claim default --owner <owner>
 
 **Fix:** Read the daemon log. The log shows which of these causes stopped the daemon.
 
+### Service commands fail because a group name does not resolve
+
+**Symptom:** On Windows, `netbird service install` and `netbird service reconfigure` fail with an error like this:
+
+```text
+Error: resolve allowed group "netbird": look up account: The trust relationship between this workstation and the primary domain failed.
+```
+
+**Cause:** The service saves the `--allow-group` names in `%ProgramData%\Netbird\service.json`. Each `install` and `reconfigure` resolves these names again. If the device cannot connect to the domain controller, the name does not resolve and the command stops.
+
+**Fix:** Do one of these steps in an elevated terminal:
+
+- To keep the restriction, set the group SID. The installer does not look up a SID. The `allow_group_ids` field in `service.json` shows the SID from the last installation.
+
+  ```shell
+  netbird service install --allow-group sid:<SID>
+  ```
+
+- To remove the restriction, set an empty value:
+
+  ```shell
+  netbird service install --allow-group=""
+  ```
+
+If the service is not installed, use `install`. `reconfigure` works only on an installed service.
+
+**Confirm:** Run `netbird service status`. Then connect to the daemon as a user in the group, for example with `netbird status`.
+
 ### Collect information for support
 
 A debug bundle includes `profiles.txt` and `active_profile.json`. These files show each profile, its owner, and the active profile. For instructions, see [Troubleshooting client issues](/help/troubleshooting-client).