It's definitely DNS.
Make sure you are handing out the DNS address of your own server - not the Netscreen.
Main Topics
Browse All TopicsI have a domain with only 1 site and two subnets. One subnet is for an office in the USA and the other subnet is for an office in the UK. Both Domain controllers are located in the US office. The two offices are connected by a PPTP VPN with a netscreen frewall at each end, the tunnels allow "any" service in both directions. You can ping all computers in either network from both locations and name resolution (DNS) is working at both locations as well. The problem is that I can not add a computer to our domain from the UK office, I get unable to find a domain controller or if I remove a computer from the domain in the UK office and then try to add it back in, I get "The trust relationship between this workstation and the primary domain failed", so basically the machines over in the UK seem to be unable to communicate with the domain controller in this regard. However the other machines that are already part of the domain are still authenticating every morning when clients login for the day...
Additionally the UK office only has 5 computers total and they won't allow me to put a domain controller over there. The domaiin itself is in 2000 mixed mode and, all workstations are XP, I checked under "AD sites and services" and as I stated at the beginning we have one site (default-site) and both subnets are listed under the subnet folder. I've run DCDiag on our domain controllers and and everything checks out good...
Any thoughts on how I can get the ability to add machines in the UK office to the domain or even some diagnotstic tools I can use the isolate the problem further?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
That was the first thing I checked and yes all UK machines have the right primary and secondary DNS server listed when you do a ipconfig /all. However manually entering the DNS servers in the properties of TCP\IP seemd to do the trick for the workstation I was troubleshooting in the UK.
Additionally after manually entering the DNS entries I needed to delete the workstation computer account from the DC, then moved the workstation to a workgroup and rebooted, then reanmed it and rebooted again. When it came backup I was able to add the workstation from the UK office to our domain here in the US. So maybe there was a problem with the sid too. Thanks for the help!
Business Accounts
Answer for Membership
by: cdnq8Posted on 2007-04-04 at 06:35:58ID: 18850415
Hi,
In your tcp ip settings put the Primary dns server address of your Domain, and than try hope fully it will authenticate with it, it seems to be a DNS ip address problem.
Taher