Solved

What type of domain trust should I use?

Posted on 2011-03-23
3
418 Views
Last Modified: 2012-05-11
Good morning,

I'm looking for advice on creating some trusts. We have several stand alone satellite offices, each with their own Forest/Domain. In the past, there has been no real need for our domain to communicate with theirs. Each office has a virtual server (with a copy of their Active Directory) in our corporate data center where they back up their critical information using DFS over our MPLS network. In the data center, we are setting up a Citrix server environment with many of the applications that these offices use for Disaster Recovery Planning. If a divisional office has some kind of disaster, hardware failure, etc. we can publish these applications to their users. Right now, since the domains are all stand alone we would have to create a login account for each user at that office on the DataCenter domain to allow them to authenticate via Citrix. I'd like to create domain trusts between each office's domain and the data center to avoid this step.

Some of the domains are 2003 and some are 2008. The domain in the data center is 2008.

I'd like it to work something like this if possible:
Office1 and DataCenter trust each other - users from Office1 can authenticate to DataCenter
Office2 and DataCenter trust each other - users from Office2 can authenticate to DataCenter
Office1 and Office2 do not trust each other - users from Office1 cannot authenticate to Office2 and vice-versa

Any advice on which type of trust would accomplish this best?
0
Comment
Question by:ECSMcLean
3 Comments
 
LVL 12

Accepted Solution

by:
Navdeep earned 500 total points
ID: 35200095
Office1 --External Forest Trust (One way)---DC

Office 2--- External Forest Trust(One Way)--DC

External Forest trusts are non transistive trusts so office 1 and office 2 will not trust each other

Additional as per your setup i don't think you need two way trust between the office1 and dc, although you can create two way trust as well
0
 
LVL 9

Expert Comment

by:binary_1001010
ID: 35200101
if  office 1 and office 2 not not under the same domain then you have to create external trust.

when you said office 1 can authenticate to datacenter, do you mean office 1 will access the resources in datacenter? then you need to create 1 way incoming(trusting) on office 1. same goes to office 2, create a 1 way create 1 way incoming(trusting).

if they are under the same domain, you need to perform naming suffux filtering.

see screenshot below.

http://windows-active-directory.net/MS.Press-MCSE.Self-Paced.Train/8403final/images/fig04_29_0.jpg

http://adopenstatic.com/images/resources/blog/Kerberos21.jpg
0
 

Author Closing Comment

by:ECSMcLean
ID: 35200123
Thanks! That was exactly what I was looking for.
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question