Solved

login/sign-in to domain on another forest

Posted on 2010-08-12
5
842 Views
Last Modified: 2012-05-10
Hello,
I have a question on login/sign-in to a domain in another forest.  

In our current structure we have a root forest, Forest 1, and 2 domains under it, Domain 1 and Domain 2.  Domain 2 is a resource domain so we login to Domain 1 to access email on the exchange server and share resources across the domain.  

We have setup another forest, Forest 2 and established trust relationship with Forest 1.  We will eventually move Domain 2 and all the objects under Forest 2.  Since Forest 2 will be a resource forest only, all our users from Domain 2 will have to login/sign-in to Domain1 so we can access the exchange server and continue sharing resources.

My question is that I am not able to see Domain 1 in drop down menu on Windows XP nor can I sign-on using Domain1\joe option.  If we have a bi-directional trust established between forests, I should be able to see Domain 1 in Forest 1 from Domain 2 under Forest 2 to login/sign-in but I can't.  I checked the DNS configuration and the forward lookup zones for the DNS is loading all the information across the forest but the reverse lookup zones cannot load all the information.  Is that the reason I'm not able to see domain1 or is there something I'm missing that I need to look into so I can see Domain 1 as an option to logon/sign-on?  What steps do I have to take so I am able to login/sign-in to Domain 1?
0
Comment
Question by:BiosIT-STJ
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
5 Comments
 
LVL 20

Expert Comment

by:woolnoir
ID: 33421663
did you try the UPN method ? i.e user@otherdomain.fulldnsname
0
 
LVL 20

Expert Comment

by:woolnoir
ID: 33421680
its been my experience that forest trusts dont populate the traditional dropdown domain selector and the above UPN method is needed.

0
 
LVL 20

Accepted Solution

by:
woolnoir earned 250 total points
ID: 33421763
( Taken from http://blogs.technet.com/b/ad/archive/2008/01/04/the-domain-logon-dialogue.aspx )

The Windows interactive logon pull down menu for domains is created by contacting a Global Catalog and querying for domains. Global Catalogs are forest specific and hence will only know of domains in their own forest. Therefore, the list will not contain domains in a trusted forest other than the root domain.
 
In other words, the MSGINA domain drop-down list retains the same functionality but with the use of forest trust rather than external trusts the list will contain only the root domain of each forest trusted by the forest in which the machine account resides.
 
Additionally, there is no built-in method in the interactive logon menu which knows to query Global Catalogs of trusted forest(s).
 
Windows Vista and Server 2008 interactive logon menu behavior does not provide a pull down menu at all and hence this is not a concern in those releases (this stems from the new CredUI replacing GINA functionality). For Vista and 2008 UPN or UNC are the typical format for the user account name for domain logon.
 
This behavior is discussed at length in the Technet article below.  That article goes into great depth on other places where the user interface behaves differently across forests as well in the Logons and Authentication section, things which I am not discussing here.
 
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/fedffin2.mspx
 
0
 
LVL 20

Expert Comment

by:woolnoir
ID: 33483240
any luck with this one ?
0
 

Author Comment

by:BiosIT-STJ
ID: 33485043
Yes, actually once we added the reverse lookup zone we were able to login using domain\username.  The UPN method didn't work but all your suggestions did guide us toward getting our problem resolved.
Thanks for taking time to address our question.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
After hours on line I found a solution which pointed to the inherited Active Directory permissions . You have to give/allow permissions to the "Exchange trusted subsystem" for the user in the Active Directory...
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question