Weird forest trust / access denied issue

Posted on 2006-04-10
Last Modified: 2008-02-01
I've just setup a 2nd forest to test disaster recovery procedures for an exchange server.  Everything seems ok, but I have one share which I'm unable to access from the test network.

Now I have 2 forests, each containing a single domain.  Trusts have been setup in both directions for these domains.  I've also configured each DNS server to act as a secondary server for the other domain.  Net result:  I can assign permissions quite happily to any account on either domain.

Problem:  One particular share is inaccessible from the test server.  Since this contains the source for exchange 2000 server, this presented a bit of a problem.  I've tried adding specific users or groups from the test network onto that share.  I've checked share and NTFS permissions.  I've even tried adding users from the test network into the users account on that machine.  Nothing seems to work.  I'm doing all this from the Administrator account on the test network.

Now, bizarely, I've just found that I'm able to access the C$ share.  This works for the server giving me problems, and my own machine.  So it appears the admin on the test network has domain admin rights on the live network.

This does give me a work around for my problem, but I'd still really, really love to know why I still get an access denied error for this particular share when C$ works fine...

Question by:myxiplx
    LVL 1

    Author Comment

    Grrr, found it.... I'd set the local admin and domain admin passwords identially on the test network.  Not a problem, but guess who was using the local account without realizing it.  Domain permissions don't do you much good if you're not logged onto the domain...

    I'm guessing the C$ share worked because I've used the same local admin password on the test network as I use on the live network.  All machines have the same username and password for the local admin account, so it's not really surprising I'd be able to get admin access.  The particular share I was struggling with however had explicit permissions set, only allowing access to domain admins and to a specific domain account on the test network.

    In summary:
    If you want to link two Windows 2000 forests, it's far easier than I thought:
     - Configure the DNS server for each domain to also run as a secondary server for other domains you need to access.
     - Create the trusts between the domains using Active Directory Domains & Trusts
     - Grant permissions as usual.  

    The only problem to look out for is that some groups cannot contain cross-forest members.  You need to either use Local or Universal groups.  If you want to be lazy, add each domains "Domain Admins" group to the "builtin\Administrators" group on the other domain.

    Posting this here in case it's useful to anybody else :)

    Accepted Solution

    Because you have presented a solution to your own problem which may be helpful to future searches, this question is now PAQed and your points have been refunded.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Better Security Awareness With Threat Intelligence

    See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

    A brief overview to explain gateways, default gateways and static routes OR NO - you CANNOT have two default gateways on the same server, PC or other Windows-based network device. In simple terms a gateway is formed when a computer such as a serv…
    Sometimes you might need to configure routing based not only on destination IP address, but also on a combination of destination IP address (or hostname) and destination port number. I will describe a method how to accomplish this with free tools. …
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now