Solved

What type of domain trust should I use?

Posted on 2011-03-23
3
417 Views
Last Modified: 2012-05-11
Good morning,

I'm looking for advice on creating some trusts. We have several stand alone satellite offices, each with their own Forest/Domain. In the past, there has been no real need for our domain to communicate with theirs. Each office has a virtual server (with a copy of their Active Directory) in our corporate data center where they back up their critical information using DFS over our MPLS network. In the data center, we are setting up a Citrix server environment with many of the applications that these offices use for Disaster Recovery Planning. If a divisional office has some kind of disaster, hardware failure, etc. we can publish these applications to their users. Right now, since the domains are all stand alone we would have to create a login account for each user at that office on the DataCenter domain to allow them to authenticate via Citrix. I'd like to create domain trusts between each office's domain and the data center to avoid this step.

Some of the domains are 2003 and some are 2008. The domain in the data center is 2008.

I'd like it to work something like this if possible:
Office1 and DataCenter trust each other - users from Office1 can authenticate to DataCenter
Office2 and DataCenter trust each other - users from Office2 can authenticate to DataCenter
Office1 and Office2 do not trust each other - users from Office1 cannot authenticate to Office2 and vice-versa

Any advice on which type of trust would accomplish this best?
0
Comment
Question by:ECSMcLean
3 Comments
 
LVL 12

Accepted Solution

by:
Navdeep earned 500 total points
ID: 35200095
Office1 --External Forest Trust (One way)---DC

Office 2--- External Forest Trust(One Way)--DC

External Forest trusts are non transistive trusts so office 1 and office 2 will not trust each other

Additional as per your setup i don't think you need two way trust between the office1 and dc, although you can create two way trust as well
0
 
LVL 9

Expert Comment

by:binary_1001010
ID: 35200101
if  office 1 and office 2 not not under the same domain then you have to create external trust.

when you said office 1 can authenticate to datacenter, do you mean office 1 will access the resources in datacenter? then you need to create 1 way incoming(trusting) on office 1. same goes to office 2, create a 1 way create 1 way incoming(trusting).

if they are under the same domain, you need to perform naming suffux filtering.

see screenshot below.

http://windows-active-directory.net/MS.Press-MCSE.Self-Paced.Train/8403final/images/fig04_29_0.jpg

http://adopenstatic.com/images/resources/blog/Kerberos21.jpg
0
 

Author Closing Comment

by:ECSMcLean
ID: 35200123
Thanks! That was exactly what I was looking for.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

A safe way to clean winsxs folder from your windows server 2008 R2 editions
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now