Fixing Failed Forest Trust

I have two forests/domains that used to have a successful trust between them. Years ago, Domain B had their domain controller replaced as it was failing. The bad one was not demoted, so the switch was not proper. After this is around when someone noticed the trust failed. Now, years later, I'm tasked with fixing the trust but I cannot seem to find any information on the errors I get.

When I run the trust verification using the GUI tool for Active Directory, it fails due to the SC. When I looked this up, it was suggested that I use the netdom trust application to fix the trust. However when I run this command on either domain controller, it fails... but with different errors.

DomainA - Windows 2008 R2 DC:
C:\Windows\system32>netdom trust domainA.local /domain:domainB.local /
userd:domainA\admin /passwordd:* /usero:domainB\admin /passwordo
:* /reset /twoway
Type the password associated with the domain user:

Type the password associated with the object user:

The specified network name is no longer available.

The command failed to complete successfully.


C:\Windows\system32>

Open in new window


DomainB - Windows Server 2003 DC:
C:\Windows\system32>netdom trust domainB.local /domain:domainA.local /
userd:domainB\admin /passwordd:* /usero:domainA\admin /passwordo
:* /reset /twoway
Type the password associated with the domain user:

Type the password associated with the object user:

Access is denied.

The command failed to complete successfully.


C:\Windows\system32>

Open in new window

Both commands are running under an account with Domain Admin, Enterprise Admin and Schema Admin rights.

Any ideas?
LVL 2
_valkyrie_Asked:
Who is Participating?
 
_valkyrie_Author Commented:
I ran the metadata cleanup but it only listed the current server, the old one didn't show up.
0
 
Mike KlineCommented:
Was that "bad DC" cleaned using metadata cleanup  http://www.petri.co.il/delete_failed_dcs_from_ad.htm

Did it hold any FSMO roles?

Thanks

Mike
0
 
_valkyrie_Author Commented:
It held all the FSMO roles at the time. Someone moved three from Active Directory's GUI but the other two I only just moved forcefully using the command line tools.

The metadata cleanup was not run. I will try that out.
0
 
_valkyrie_Author Commented:
Also the GUI error that I get when resetting the trusts is:

DomainA
The outgoing trust was successfully validated.

The secure channel (SC) verification on Active Directory Domain Controller \\DC.domainB.local of domain domainB.local to domain domainA.local failed with error: Access is denied.

The secure channel (SC) reset on Active Directory Domain Controller \\DC.domainB.local of domain domainB.local to domain domainA.local failed with error: Access is denied.

Open in new window


DomainB
The secure channel (SC) verification on domain controller \\DC.domainB.local of domain domainB.local to domain domainA.local failed with error: Access is denied.

The secure channel (SC) reset on domain controller \\DC.domainB.local of domain domainB.local to domain domainA.local failed with error: Access is denied.

The incoming trust was successfully validated.

Open in new window

0
 
_valkyrie_Author Commented:
Since no one else is offering ideas, I'm going to close this question. Problem still isn't resolved.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.