Weird forest trust / access denied issue

I've just setup a 2nd forest to test disaster recovery procedures for an exchange server.  Everything seems ok, but I have one share which I'm unable to access from the test network.

Now I have 2 forests, each containing a single domain.  Trusts have been setup in both directions for these domains.  I've also configured each DNS server to act as a secondary server for the other domain.  Net result:  I can assign permissions quite happily to any account on either domain.

Problem:  One particular share is inaccessible from the test server.  Since this contains the source for exchange 2000 server, this presented a bit of a problem.  I've tried adding specific users or groups from the test network onto that share.  I've checked share and NTFS permissions.  I've even tried adding users from the test network into the users account on that machine.  Nothing seems to work.  I'm doing all this from the Administrator account on the test network.

Now, bizarely, I've just found that I'm able to access the C$ share.  This works for the server giving me problems, and my own machine.  So it appears the admin on the test network has domain admin rights on the live network.

This does give me a work around for my problem, but I'd still really, really love to know why I still get an access denied error for this particular share when C$ works fine...

Ross
LVL 1
myxiplxAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

myxiplxAuthor Commented:
Grrr, found it.... I'd set the local admin and domain admin passwords identially on the test network.  Not a problem, but guess who was using the local account without realizing it.  Domain permissions don't do you much good if you're not logged onto the domain...

I'm guessing the C$ share worked because I've used the same local admin password on the test network as I use on the live network.  All machines have the same username and password for the local admin account, so it's not really surprising I'd be able to get admin access.  The particular share I was struggling with however had explicit permissions set, only allowing access to domain admins and to a specific domain account on the test network.

In summary:
If you want to link two Windows 2000 forests, it's far easier than I thought:
 - Configure the DNS server for each domain to also run as a secondary server for other domains you need to access.
 - Create the trusts between the domains using Active Directory Domains & Trusts
 - Grant permissions as usual.  

The only problem to look out for is that some groups cannot contain cross-forest members.  You need to either use Local or Universal groups.  If you want to be lazy, add each domains "Domain Admins" group to the "builtin\Administrators" group on the other domain.

Posting this here in case it's useful to anybody else :)
EE_AutoDeleterCommented:
myxiplx,
Because you have presented a solution to your own problem which may be helpful to future searches, this question is now PAQed and your points have been refunded.

EE_AutoDeleter

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Networking

From novice to tech pro — start learning today.