[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Cannot create forest trust

Posted on 2007-08-07
19
Medium Priority
?
2,233 Views
Last Modified: 2013-11-05
I am trying to create a two-way forest trusts between 2 windows 2003 forests that are operating at 2003 forest functional levels.  It creates fine on forest A but not forest B.  DNS Zones are appropriately created in each forest.  The only error given is:

"The trust relationship cannot be created because the following error occurred:
The operation failed.  The error is:  the parameter is incorrect."

How do I determine which parameter it is having a problem with.
0
Comment
Question by:binnykuriakose
  • 10
  • 9
19 Comments
 
LVL 51

Expert Comment

by:Netman66
ID: 19648466
Are you able to ping both the domain fqdn and servername of the other forest's Root DC?

You must create the Trusts with both Root DCs only.

0
 

Author Comment

by:binnykuriakose
ID: 19648503
yes.  able to ping fqdn.  trying to create the trusts with the root dcs.  not working.
any ideas?
0
 
LVL 51

Expert Comment

by:Netman66
ID: 19648531
The way I'd attempt to set it up is as follows:

1)  Rather than creating zones on opposite DNS server, we would use Conditional Forwarding for the domains in question.  This is set up on the Forwarders tab.
2)  Once done, ping fqdn and NetBIOS domain names to see if they resolve.  NetBIOS may not.
3)  Create one end of each trust on one server, then attach to the other and do the same.

Relying on secondary zones doesn't give you the SRV records you need to get proper lookups.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:binnykuriakose
ID: 19648648
ok. tried that.  still no luck.  can you suggest any other methods or how the error can be narrowed down.
0
 
LVL 51

Expert Comment

by:Netman66
ID: 19648730
You're pretty fast!

So you now no longer host any zones from the opposite Forests - correct?  You need to delete them and allow replication to clean up the remaining zones from the other DNS server before moving forward.

Once added as a Forwarder, you should be able to use NSLOOKUP to do a DC lookup from the opposite domain and get a proper reply.

Once that works, then use FQDN in the Trust.  Do one end at a time to see where it falls down (if it does).

0
 

Author Comment

by:binnykuriakose
ID: 19649232
ok.  i think i got somewhere with this.  i believe the issue is that a trust somehow already exists between the forest even though none is listed in the 'domain and trusts' mmc.  i can confirm this since when I type:  "\\domain.root"  from a run command (from either forest), it opens the domain share with sysvol, etc listed.  I can browse policies etc.  Forest B is a VM on a box that is a member of a domain in Forest A.  I don't think that is the problem since the VM knows it is a member of domain in Forest B.    Any idea how the trust is getting created?

One more twist, if I create a trust such that Domain B trusts Domain A, and I type type:  "\\domain.root"  (referring domain B) from a run command (from domain A), it will error out saying that the trust failed.  

So when there are no valid trusts listed, it behaves as though there is.  When there is valid trust listed, the trust relationship fails.

Any ideas?
0
 

Author Comment

by:binnykuriakose
ID: 19649264
actually, realized that what I listed as an issue is probably ok.  by default, all DCs allow everyone to browse their directories that can access them on the network.
 
However, still can't get the trusts created.  The NSLookups of SRV records work fine.
0
 
LVL 51

Expert Comment

by:Netman66
ID: 19650698
OK, what account are you using to create the Trusts?

0
 

Author Comment

by:binnykuriakose
ID: 19653839
It is the built-in administrator account with who is a member of domain admins, enterprise admins, and schema admins.
0
 
LVL 51

Expert Comment

by:Netman66
ID: 19653976
Okay, that would work on one end, are you using the matching account on the other?

Do you have domain communication allowed through the firewall/router?

0
 

Author Comment

by:binnykuriakose
ID: 19654114
yes.  matching account on the other end.  No FW or router.
0
 
LVL 51

Expert Comment

by:Netman66
ID: 19654172
Are these on the same wire?

Perhaps a short rundown of the setup may help in the thinking process.

0
 

Author Comment

by:binnykuriakose
ID: 19655571
Yes.  All on the same wire.  
2 Forests with 2 Domains in each Forest - 2 DCs in Domain A in 1 DC in Domain B.
Domain A also has a child domain.
All DCs are Windows 2003.
A trust can be made from Domain B (trusting Domain A).
A trust cannot be made from Domain A (trusting Domain B).
I believe the problem is with Domain B.  Some issue is preventing Domain A from creating a trust with it.
0
 
LVL 51

Expert Comment

by:Netman66
ID: 19655617
How are the two subnets communicating?  Are they VLAN'd?  Is the routing between VLANs correct?

It seems like there is an access list one way that may be preventing some proper communication.

You are putting in the Root DC for Forest A when attempting the Trust from B - correct?

0
 

Author Comment

by:binnykuriakose
ID: 19655705
No VLANs and only one subnet.  Communication is not an issue.  They can see each others resources and query SRV records fine.

What do you mean by "You are putting in the Root DC for Forest A when attempting the Trust from B - correct?"

There is no place to put a 'Root DC' during configuration-only the forest name.  Am I missing a step?
Do you mean:  am I configuring the trust on the Root DC?  - I am.
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 2000 total points
ID: 19655820
Sorry, that was a typo....

You understood the statement fine.

I think the issue may lie in the fact that both forests are in the same subnet - this is certain to screw up replication and site boundaries.  I would be looking to separate the Forests into two distinct subnets before trying this again.

Is this a test scenario?  
0
 

Author Comment

by:binnykuriakose
ID: 19664626
Yes.  This is in a test environment.  I now separated the forests to different subnets.  The error persists.  
I also tried moving to the FSMO roles in Forest A to a new DC and tried creating the trust from the new DC with the FSMO roles.  no luck.
Any thing else that could help here?
0
 

Author Comment

by:binnykuriakose
ID: 19666107
I rebuilt the DC and this resolved the issue.   Not sure what the problem was, but thanks for troubleshooting.
0
 
LVL 51

Expert Comment

by:Netman66
ID: 19667101
Wow...well, there comes a point when it's more time-effective to start fresh.  Sorry I couldn't put my finger on it for you.

I appreciate the points.

NM
0

Featured Post

Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Organizations create, modify, and maintain huge amounts of data to help their businesses earn money and generally function.  Typically every network user within an organization has a bit of disk space to store in process items and personal files.   …
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Is your OST file inaccessible, Need to transfer OST file from one computer to another? Want to convert OST file to PST? If the answer to any of the above question is yes, then look no further. With the help of Stellar OST to PST Converter, you can e…

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question