?
Solved

establish 2-way trust between two physically separated AD domains

Posted on 2012-03-09
2
Medium Priority
?
500 Views
Last Modified: 2012-08-13
Hello,

I need to establish a two-way trust between 2 physically separated AD domains - when I run through the "create new trust" wizard and supply either side with the other side's domain name, the wizard will error out and tell me it cannot find the supplied Windows Domain.

Additional details:
there is a site to site VPN in place that enables connectivity between the two sites and hosts on either side are pingable and accessible by IP - general high level infrastructure concerns are pretty solid and there is no firewalling of the traffic between the two sites.

One domain controller on one side can ping the other by name, the other one cannot by name, but can by IP

The AD on one side has a domain functional level of 2003 / forest 2008

The AD on the other side has a domain functional level of 2000 / forest is 2003

One AD has a ".us" ending to its' internal NETBios domain name, the other has a ".com" ending to its' internal NETBios domain name :-/


What is the best way to configure DNS in this situation? Obviously I would like to avoid an internal domain re-name on the one that ends in ".com"

Will the functional levels need to be raised to support the trust?



The goal here is very simply to be able to login to computers at one site with credentials from the other site.

Thank you!
0
Comment
Question by:Bill Welsh
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 2000 total points
ID: 37703714
You can use conditional forwarders for name resolution    (stub zones and secondary zones would work too) http://technet.microsoft.com/en-us/library/ee307976(v=ws.10).aspx

So you set a conditional forwarder in domain A to point to domain B and vice versa.

Also make sure your ports are open

http://support.microsoft.com/kb/179442

Thankjs

Mike
0
 

Author Closing Comment

by:Bill Welsh
ID: 37715879
The newly created conditional forwarders at both sites fixed this problem beautifully, much appreciated!
0

Featured Post

Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Here's a look at newsworthy articles and community happenings during the last month.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question