?
Solved

Authenticating on internal domain from DMZ

Posted on 2004-09-02
3
Medium Priority
?
238 Views
Last Modified: 2013-12-04
Hey folks,

I need to authenticate users connecting through VPN to our DMZ on our internal AD-Domains. Would it be enough to allow authentication with 1 DC in the top domain?

Shouldnt the TopDomain be able top authenticate for the sub-domains or atleast request and pass on authentication?

Please let me know if anyone of you know :)

/Rene
0
Comment
Question by:LamerSmurf
  • 2
3 Comments
 
LVL 16

Accepted Solution

by:
JamesDS earned 1000 total points
ID: 11963385
LamerSmurf
If you allow access from the DMZ to only a domain controller in the root domain, then users will not be able to logon fully - without using cached credentials. The reason for this is that things like domain local group memberships are not replicated to all Global Catalogs and therefore are unavailable to Domain Controllers ouside of the users home domain. Without this information the user cannot be logged on, unless cached credentials are available.

The likely message a user will receive is "The user cannot log in because the domain DOMAIN is not available."

you need to allow the DMZ access to at least one domain controller in each domain.

Cheers

JamesDS
0
 
LVL 3

Expert Comment

by:Gargantubrain
ID: 11968976
Well actually Active Directory domains are two-way transitive trusts. So the whole forest trusts itself. The handshake can take longer without additional short-cut trusts created but it will work.
0
 
LVL 3

Expert Comment

by:Gargantubrain
ID: 11969012
Now that I think about it, the client on the outside of the VPN may not be able to make all of the kerberos handshakes if it can't contact each domain. I was initially speaking from the standpoint of a client that is in the network.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, a new law in my state forced us to get a top-to-bottom analysis of all of our contract client's networks. While we have documentation, it was spotty at best for some - and in any event it needed to be checked against reality. That was m…
Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
The Relationships Diagram is a good way to get an overall view of what a database is keeping track of. It is also where relationships are defined. A relationship specifies how two tables connect to each other. As you build tables in Microsoft Ac…
Planning to migrate your EDB file(s) to a new or an existing Outlook PST file? This video will guide you how to convert EDB file(s) to PST. Besides this, it also describes, how one can easily search any item(s) from multiple folders or mailboxes…
Suggested Courses

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question