Solved

publish DFS resource in an external trusted domain

Posted on 2011-09-22
3
3,589 Views
Last Modified: 2012-12-11
Hi,

I'm implementing DFS in a local domain (test laboratory) and I'm working with it without any problem inside this domain, but according to my company setup, I would like that my DFS was reacheable from the corporate domain. My domain has a trust relationship with the corporate one (separate forests). The trust type is External and No transitive (the users from the corporate domain an access to the resources from the local domain).

The question is if there is a way to publish in the corporate domain my DFS service... When I try to get it from any resource in the corporate domain, I get a network error "Windows cannot access \\mydomain\dfsroot"...

Thanks in advanced.
Regards
0
Comment
Question by:ecemibm
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 9

Accepted Solution

by:
Lester_Clayton earned 500 total points
ID: 36583445
I'm afraid you cannot do this - DFS shares are only accessible from the same domain that they're published.

What you CAN however do is create a DFS Namespace in the domain, and then add the folder of the trusted domain's server.

For example:

Domain A:

DFS Namespace: \\contoso.com\Root
DFS Folder \\contoso.com\Root\Folder = \\contoso02.contoso.com\Data$

Domain B:

DFS Namespace: \\microsoft.com\Root
DFS Folder: \\microsoft.com\Root\Folder = \\contoso02.contoso.com\Data$

Now you can access the same location on either domain using the path \\%USERDNSDOMAIN%\Root\Folder
0
 

Author Closing Comment

by:ecemibm
ID: 36583931
That's what I suspect... thanks for the confirmation and the way to do it.
0
 
LVL 18

Expert Comment

by:LesterClayton
ID: 38678480
It seems that my other self was incorrect.

It *is* possible to access DFS shares cross domain or cross forest, as long as you have either prepared the DFS Root properly, or if you use one of the workarounds.

The reason why it doesn't work by default is because when creating DFS roots, the referalls are not being created using Fully Qualified Domain Names - they're created using just servernames, which naturally, anybody outside of the domain won't be able to resolve.

Here is the correct way of doing it:

How to configure DFS to use fully qualified domain names in referrals

This will require a recreation of the DFS root.

As far as workarounds are concerned, you have 2 options:

Option 1: DNS Search Scopes.

What you can do is add the target DFS's domain name to the DNS Suffix Search List of all clients in the requesting domain.  Modifying DHCP to add the DNS domain as a DNS Suffix is the easiest way to do this.  

For example, if you have a DNS root which is \\abc.com\blah (which server a01.abc.com is serving), then the referral will be \\a01\blah, and the clients in def.com will try to resolve a01.def.com and then a01.abc.com - thus getting the referral to work.

Option 2 : CNames

Another option is to create a CName in the requesting domain to point to the A record in the target domain.

For example, if you have a DNS root which is \\abc.com\blah (which server a01.abc.com is serving), then the referral will be \\a01\blah.  The clients in def.com will try to resolve a01.def.com, and this will normally fail.  What you do here is create a CNAME for a01 in def.com's zone, and make it resolve to a01.abc.com.  Resolution will now work as will the referrals.

I apologise for my erroneous answer from last year.
0

Featured Post

Ready to get started with anonymous questions?

It's easy! Check out this step-by-step guide for asking an anonymous question on Experts Exchange.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question