Solved

Group policy, DNS suffix and Net Use

Posted on 2010-09-14
6
620 Views
Last Modified: 2012-05-10
I’ve implemented a Group Policy on Windows Server 2003 that simply assigns a DNS suffix list to XP clients.  I have assigned this to the default group policy.  The purpose for this is to allow host names in a secondary domain to be identified.  Before I did this we would simply amend local host files for users who needed to resolve host names in the secondary domain.    

However, users who access the second domain also have a local BAT file that’s maps and authenticates access to a server in the secondary domain (using Net Use).  Without the local host files mentioned above the BAT file fails to access the secondary domain server and map the drive.  However I can ping the server in question from the associated client using the domain suffix group policy and ipconfig /all shows both domains.  

With the secondary domain host file the BAT file mapping works.

Hope this makes sense.

And comment s as to what the problem is are welcome.  
0
Comment
Question by:DHPBilcare
  • 3
  • 2
6 Comments
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
You need to setup DNS Forwarders within your DNS to point to the second Domain's DNS servers this will allow the clients to append the suffix then look to DNS for the proper IP address.

If you don't want to do that you can use IP addresses within your Bat file instead of names.
0
 
LVL 17

Expert Comment

by:Tony Massa
Comment Utility
Are you saying that from CLIENT.DOMAIN1.NET, you can ping SERVER1 and get a response from SERVER1.DOMAIN2.COM?  I think Darius is on track here.  Adding conditional forwarders to your DNS servers would certainly be expected in your scenario.

How to add AD-Integrated Conditional Forwarders:
http://msmvps.com/blogs/ulfbsimonweidner/archive/2006/09/30/DNS-Conditional-Forwarders-_2D00_-AD-integrated.aspx
0
 

Author Comment

by:DHPBilcare
Comment Utility
Sorry I should have added that I have already added the second domain as a secondary domain on my internal DNS Servers.  

This includes both a primary and secondary DNS serve address for the second domain.
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:DHPBilcare
Comment Utility
I've tried replacing the host name with IP in the BAT file and still no luck.
0
 

Author Comment

by:DHPBilcare
Comment Utility
Ignore my last post, the change to IP in the BAT file works.  

However why is the hostname not being resolved in the BAT file when I can ping the host at the cmd prompt?
0
 
LVL 17

Accepted Solution

by:
Tony Massa earned 500 total points
Comment Utility
If I'm not mistaken, UNC connections will always try NETBIOS.  PING isnt the same process as NET USE  Try going to the RUN command and type \\SERVER\. Does it find it?  Just use the FQDN in your bat would fix it.

You can test with wireshark to confirm that the PC isn't using DNS. Is there WINS in your domains?
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Suggested Solutions

Do you have users whose passwords are expiring and they are constantly calling you?  Well I sure did and needed a way to put an end to this.  We have a lot of remote users which would not be notified that their passwords were expiring since they wer…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now