Create Trust between 2000 mixed mode forest and 2008 Forest

Bradley1975
Bradley1975 used Ask the Experts™
on
Question: We are currently running a Windows 2000 Mixed mode environment. We are currently building a Windows 2008 domain in an entirely new forrest. We need to be able to create a trust between the two seaparate forrests.

Question: What do I need to do to make this happen? I keep getting mixed responses on how these trusts work. Some responses I hear are that if you put the forest functional level at 2008, then you cant add any sub domains in the forrest that have domain controllers less than 2008. Which I am fine with that because we plan to go full 2008 in this environment.

   But to move users over to the new domain, I need resources accessible from both the Windows 2000 mixed domain and the Windows 2008 domain. Does this mean that in order to create a trust between two separate forests (Windows 2000 mixed and Windows 2008) that I need to set a lower forest level and then set it higher once I break the trust?

Any help would be appreciated.

Thanks!!!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Do you still have Windows 2000 servers in the mixed mode domain?   If you can upgrade that domain to a domain functional level, you would have no problems.   I think it's possible to set up trusts between Windows 2000 and Windows 2Kx but there are caviats..

I got the below from this technet site...
http://technet.microsoft.com/en-us/library/cc757352%28WS.10%29.aspx#w2k3tr_trust_what_xegt

Trusts across Windows Server 2003 and Windows 2000 forests

Windows Server 2003 forest trusts cannot be created between a Windows Server 2003 forest and a Windows 2000 forest. You can, however, manually create a trust relationship between any domain in a Windows Server 2003 forest and any domain in a Windows 2000 forest by using one-way or two-way external trusts. External trusts are nontransitive and provide for access to resources in another domain outside the forest that is not already joined by a forest trust.

Author

Commented:
It is corrrent that in our WIndows 2000 mixed mode domain, all our domain controllers are WIndows 2000 servers and our member servers are a mix of Windows 2000 and WIndows 2003. If I read the webpage correctly, I can have a Windows 2000 mixed mode domain in 1 forest and a Windows 2008 domain (2008 Functional level) in a separate forest. Then I could create external trust to allow users from both domain to share resources and applications? Does this sound right?
bluntTonyHead of ICT
Top Expert 2009

Commented:
Hi there,
Are both forests single-domain? If so, you don't need to worry about creating a forest trust as it would have no additional benefit anyway. A forest trust is useful when you have two multi-domain forests and you want all domains in one/both forests to be trusted.
If it's two single domain forests, then an external trust will do the same job as a forest trust anyway. You wouldn't have to raise/lower functional levels to create an external trust. Create a two-way external trust and this should allow the migration.
Tony

Author

Commented:
The new domain will be a single domain in a forest, but the one Im moving from has a root forrest and child domain. The thing is though I dont need anything from the root forrest, I just need to access resources from the child domain. So Im assuming I just need to do a domain trust between my new domain and the child domain.
Head of ICT
Top Expert 2009
Commented:
Yes that would be correct. Providing you have a trust between the new domain and the one you want to migrate from, that should suffice.
Tony

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial