Solved

Active Directory Forest Problem & Trusts

Posted on 2004-08-01
10
304 Views
Last Modified: 2010-04-12
Ok, I have an interesting issue that I hope I can get a resolution on.

Let me state the facts first:

1. About a year ago we opened a new remote location and installed a new server as a separate domain and named it remote1.mydomain.com it was created in a new tree & new forest (I guess the thinking was that it was going to be a separate entity and that 2000 server was no where else in our organization)

2. A month ago our corporate offices upgraded to 2000 & AD, the domain was named mydomain.com and was created in a new tree & new forest (still no one was thinking that the 2 domains needed to access eachother).

3. Upgraded to Exchange 2000 Server and then decided that it was an urgent necessity to have these two domains trust eachother.

Problem:

The issue is that I cannot for the life of me get these 2 domains to trust eachother. They are in separate forests & trees but have a similar DNS name (one called remote1.mydomain.com & mydomain.com). I originally thought it was a DNS resolution issue, but know I really dont know and was hoping some of you experts might be able to assist me.

Demoting & Repromoing the remote location should be considered last resort as well as upgrading it to 2003 server and renaming it.

Can I create a trust between these two locations?
Thanks. Also, question points will be increased to 500 shortly (250 is all i have right now but I am purchasing more)
0
Comment
Question by:lindows101
  • 6
  • 3
10 Comments
 
LVL 11

Accepted Solution

by:
NetoMeter Screencasts earned 370 total points
ID: 11693540
Hi!
My question is about “remote1.mydomain.com”.
Is that the name of the remote Domain or the name of the remote Domain Controller in the duplicate domain “mydomain.com”?
I am thinking about the following trick. Let’s call the main domain - Domain1 and the remote domain - Domain2.
The idea is to create a child domain at the remote location – child.Domain1. Then delegate a DNS zone for child.Domain1 at Domain2. Then create a cross-forest trust between child.Domain1 and Domain2. The final step would be moving the users with ADMT.
Of course that has to be done in a Lab environment first. If I have some time today I’ll give it a try.

I do not think that there is a way to merge the two AD because they have different Schemas and different GC’s.
If Remote1.mydomain.com is not the name of the DC at Domain2 but the FQDN of Domain2 then you can try to create a zone delegation at Domain1 for the zone “remote1.mydomain.com” to the DC at Domain2. Set a forwarder at the DNS server at Domain2 pointing to Domain1’s DNS server and try creating a cross-forest trust.

NetoMeter
<removed by cs>
0
 
LVL 13

Expert Comment

by:ocon827679
ID: 11694197
I think that your problem is that the domain are the same name - mydomain.com.  The remote1.mydomain.com is being viewed as a subdomain of mydomain.com.  I would think that AD is having a problem with this naming since the remote1.etc is a logical subdomin of mydomain.com.

You might want to try taking a workstaion or server and installing W2K server, promoting it to another domain, with a totally different name, like joe.com.  Then see if you can set the trust, using the same procedures that you are using now.  If it works, then your pointing at a naming issue.
0
 

Author Comment

by:lindows101
ID: 11694602
Netometer,
The remote domain is acutally named remote1.mydomain.com, the server is server1.remote1.mydomain.com

0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 

Author Comment

by:lindows101
ID: 11694962
Netometer,
Now do I need to create any DNS entries on each end so the DC's can resolve eachother?

I will try out your recommendation of zone delegation here in about in hour, but just wanted to see if I need to add some DNS records first so the DC's kind find eachother, or if that is what we are trying to accomplish by adding the zone delegation.
0
 

Author Comment

by:lindows101
ID: 11695272
YEHAW!
Created the zone delegation, added the forwarder, and everything works excellent!!!

Netometer, you have no idea how much stress and frustration you just releaved from me!

I will accept the answer in a bit here (want to increase the points first, and am waiting on a refund from another question)
0
 

Author Comment

by:lindows101
ID: 11695443
Actually... one more issue now... On my DC at our corporate offices (mydomain.com) I can access resources from remote1.mydomain.com directory just fine. However once I go to my exchange server and try to make a user account change it basically gives me a message that it cannot contact the domain. I am figuring that must be some sort of DNS resolution problem, but I cannot figure out why my DC running DNS can access it fine and this server cannot.... any clue?
0
 

Author Comment

by:lindows101
ID: 11695579
The Specific Error I get is:

The server is not operational.
0
 
LVL 11

Expert Comment

by:NetoMeter Screencasts
ID: 11699733
Hi!
I just finished replicating your configuration in a test lab and it worked fine.
I have also exchange 2000 in Domain1 which is running on a separate server (not a domain controller) and everything works fine.
I would suggest to install support tools from Windows 200 installation CD on your Exchange server – here is an example:
http://www.netometer.net/samples/adinitsteps/step1/step1.html
Try running this from command prompt on the Exchange server (by the way is the Exchange running on a  member server or on a DC):
nltest /dsgetdc:yourdomain.com
nltest /dsgetdc:remote1.yourdomain.com
What is the result?

NetoMeter
<removed by cs>
0
 

Author Comment

by:lindows101
ID: 11700115
Actually, I just needed to add SRV records in DNS for the remote domain and then everything functioned fine (after I used your method of course)

You saved me many headaches NetoMeter, thanks for spending the time to help me out.

Also.... I can award points now, or if you wait 3 days till my points are refunded in another question I can increase them to 500.. your call. But I would like to give you the max.
0
 
LVL 11

Expert Comment

by:NetoMeter Screencasts
ID: 11703322
Hi!
I am glad that my suggestion was helpful. I am not in a hurry about the points

NetoMeter
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
There’s a good reason for why it’s called a homepage – it closely resembles that of a physical house and the only real difference is that it’s online. Your website’s homepage is where people come to visit you. It’s the family room of your website wh…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question