?
Solved

Group policy, DNS suffix and Net Use

Posted on 2010-09-14
6
Medium Priority
?
636 Views
Last Modified: 2012-05-10
I’ve implemented a Group Policy on Windows Server 2003 that simply assigns a DNS suffix list to XP clients.  I have assigned this to the default group policy.  The purpose for this is to allow host names in a secondary domain to be identified.  Before I did this we would simply amend local host files for users who needed to resolve host names in the secondary domain.    

However, users who access the second domain also have a local BAT file that’s maps and authenticates access to a server in the secondary domain (using Net Use).  Without the local host files mentioned above the BAT file fails to access the secondary domain server and map the drive.  However I can ping the server in question from the associated client using the domain suffix group policy and ipconfig /all shows both domains.  

With the secondary domain host file the BAT file mapping works.

Hope this makes sense.

And comment s as to what the problem is are welcome.  
0
Comment
Question by:DHPBilcare
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 33674974
You need to setup DNS Forwarders within your DNS to point to the second Domain's DNS servers this will allow the clients to append the suffix then look to DNS for the proper IP address.

If you don't want to do that you can use IP addresses within your Bat file instead of names.
0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33675849
Are you saying that from CLIENT.DOMAIN1.NET, you can ping SERVER1 and get a response from SERVER1.DOMAIN2.COM?  I think Darius is on track here.  Adding conditional forwarders to your DNS servers would certainly be expected in your scenario.

How to add AD-Integrated Conditional Forwarders:
http://msmvps.com/blogs/ulfbsimonweidner/archive/2006/09/30/DNS-Conditional-Forwarders-_2D00_-AD-integrated.aspx
0
 

Author Comment

by:DHPBilcare
ID: 33680854
Sorry I should have added that I have already added the second domain as a secondary domain on my internal DNS Servers.  

This includes both a primary and secondary DNS serve address for the second domain.
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:DHPBilcare
ID: 33680956
I've tried replacing the host name with IP in the BAT file and still no luck.
0
 

Author Comment

by:DHPBilcare
ID: 33681031
Ignore my last post, the change to IP in the BAT file works.  

However why is the hostname not being resolved in the BAT file when I can ping the host at the cmd prompt?
0
 
LVL 17

Accepted Solution

by:
Tony Massa earned 2000 total points
ID: 33681381
If I'm not mistaken, UNC connections will always try NETBIOS.  PING isnt the same process as NET USE  Try going to the RUN command and type \\SERVER\. Does it find it?  Just use the FQDN in your bat would fix it.

You can test with wireshark to confirm that the PC isn't using DNS. Is there WINS in your domains?
0

Featured Post

Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question