Solved

Segregating a group of PC's so a domain can't access them

Posted on 2004-09-27
7
155 Views
Last Modified: 2010-04-13
We have all of our 2000 network running on one domain in one forest.  We still have an old NT domain running separate from the 2000 domain.  We want to move the NT domain to 2000, but we don't want anyone from the 2000 domain to be able to access the PC's from the NT domain.  The server in the NT domain runs some very critical plant software which we don't want anyone to be able to tamper with.  The PC's in the NT domain will need to use the email system in the 2000 domain.  What's the best way to accomplish moving the NT domain to 2000 but keeping it separate for security reasons?

Thanks in advance.
0
Comment
Question by:turtletrax
7 Comments
 
LVL 15

Expert Comment

by:Yan_west
ID: 12159998
You could put the 2 networks on different subnet.. these 2 network would be isolated by a router.. using ACLs to completly block the communication between the 2...
0
 
LVL 15

Expert Comment

by:Yan_west
ID: 12160014
Network 1
PC1
PC2
------------
ROUTER
-----------
Network 2
PC 3
PC 4..etc..

With an ACL, you could give or remove access to certain IP addresses from 1 domain to the other.. or only give access to certain ports.. in fact, you can pretty much do anything you want..
0
 
LVL 33

Expert Comment

by:NJComputerNetworks
ID: 12161010
Define "Access them".  Creating seperate networks as already suggested will work; however, from a security propective users from the 2000 domain can't access resources in the NT domain by default (unless they have the same username and password in both domains).

So, just having these two domains on the same network will not give users access to both domains.  If the administrators sets up identicle usernames and password in both domains; however, you will run into a problem.

Even if you setup a trust relationship between the two domains, users will not automatically be given rights to access the other domain (unless they are part of the administrators group and have already been given rights.)

Thank you,

Joe Poandl MCSE
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 4

Expert Comment

by:darth_wannabe
ID: 12161019
you can have only a one-way trust relationship set up, that way only the users from the NT domain can get the the 2000 domain, but not vice versa
0
 

Author Comment

by:turtletrax
ID: 12161123
Our plan is to eliminate the NT domain and move the computers into the 2000 domain.  Only the PC's from the NT domain need to access each other.  
0
 
LVL 15

Accepted Solution

by:
Yan_west earned 500 total points
ID: 12161208
Isolate them by a router... that way you'll be sure that there is no access between the networks.. or you can customize whatever access you want to provide..
0
 
LVL 33

Expert Comment

by:NJComputerNetworks
ID: 12161230
You can safely setup a one way to two way trust.  As long as you don't give NTFS/SHARE level access from the remote domains, you will not have a problem.  To be safe though, you can setup a one way trust where the 2K domain trusts the NT domain.  

You will need to setup a trust anyway if you are going to use the ADMT (Active Directory Migration Utility) to perform the migration.

Thank you,

Joe Poandl MCSE


0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This article lists the top 5 free OST to PST Converter Tools. These tools save a lot of time for users when they want to convert OST to PST after their exchange server is no longer available or some other critical issue with exchange server or impor…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now