Adding Active Directory Users to Local Accounts - partial domain connectivity

Posted on 2006-05-24
Last Modified: 2010-04-18
I have a strange issue.  I have the computer hooked up to a 2003 AD domain.  It has trust relationships to other domains - one of them NT.  When I look at the users from the user list in Active Directory, I can see all of the users from other domains.  The trust seems to be intact.  But, when I go to add domain users to a local user or group, the 2003 AD domain is not available, but the other trusted domains are available.  Any thoughts?  This is really strange.
Question by:awakenings

    Author Comment

    Question, could a PIX ASA block the trust relationship in some way?  Everything is permitted otherwise.

    Author Comment

    This issue is appearing on more than one box.
    LVL 3

    Expert Comment

    You may wish to try resetting the domain machine account and the secure channel between the affected workstations and the 2k3 domains itself.

    To do this, you'll need the Windows 2003 Server SP1 Support Tools, which (if you haven't already got) can be downloaded here:

    Install the tools on a workstation you know is working correctly. Once you've done that, run the following command (once for each affected workstation):

    NETDOM RESET workstation_name /Domain:domain_name

    Once you've done that, and it reports successful, confirm it by verifying the connection using the command:

    NETDOM VERIFY workstation_name /Domain:domain_name

    If succesful, you should get a response like this:

    The secure channel from FOO to the domain BAH has been verified.  The connection
    is with the machine \\DC1.BAH.COM
    LVL 51

    Expert Comment

    I don't think there's anything wrong.

    Explain what you are attempting to do?

    Group nesting is not possible, however, some users can be nested into groups on the opposite domains depending on what groups you are attempting this on.


    Author Comment

    Sanx69, I'll ask the MIS staff to try that tomorrow.  I'm pretty sure those computers are connected to the domain however -- I'll save the complex details of how the staff work, but doing that may be a chore.

    Netman66, what we are doing IS possible.  One can clearly see the other trusted domains, but not the domain that the station is in.  It is very weird.  It is also very wrong.  Trust me on this one.
    LVL 1

    Accepted Solution

    PAQed with points refunded (500)

    Community Support Moderator

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
    Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now