how does work the authentication in a Forest Trust ?

Hi Experts,
here is my pb :

I've got a Forest A (with only 1 domain, 2003 native mode), i've got another Forest B (with 1 root domain, and 20 child domains, 2003 native mode).

I opened network flow through Firewall to let communicate DCs from domain A and DCs from the root domain B .

So i was able to make a forest trust without problem.

I can add user from the root  B to groups of the domain A.

But now, if I want to add users from childs domains of the forest B to groups of domain A, i've got an error like " unable to communicate to the domain controller".

My question is : Should I open network flow between Forest 1 DCs and all DCs of the Forest B ? (included all childs domains DCs)
If yes, I can't understand where is the benefit to make a trust forest instead of multiple domains trusts.

Or maybe in my configuration i've to work with command line to manage AD ?


Thanks !
LVL 1
Carlito985Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Leon FesterSenior Solutions ArchitectCommented:
You should still open firewall rules to allow you DC's in your child domain to connect to the other forest.

While the forest trust allows you to setup only one trust for all your domain, each domain controller will do it's own authentication requests to the

This article should show you nicely how it works.
Check out the setions for
Trust Architecture
Trust Processes and Interactions

http://technet.microsoft.com/en-us/library/cc773178(v=ws.10).aspx
0
Carlito985Author Commented:
Thanks !
I understood, But with your comment, i don't understand the benefit of a shortcut trust, can you explain me ?
0
Leon FesterSenior Solutions ArchitectCommented:
My statements is based on the understaning of how the trust hierarchy and authentication flow
works.

As soon as you introduce a shortcut trust you're essentially changing the authentication flow so that it no longer needs to traverse the trust hierachy.

A shortcut trust doesn’t give either domain access to anything new, but rather it just sorta introduces the two domains to each other. Once the shortcut trust is in place, the two domains can access each other directly without having to traverse the forest in an attempt to locate a domain controller.

Also remember, a shortcut trust can only be created between domains in the same forest.

Your multi-domain forest may be a good candidate for a shortcut trust if you have roaming users user who are complaining about the amount of time it takes for them to be authenticated.

Check out this article, it's not quite for your scenario, but it shows how shortcut trusts can be used to reduce/improve the authentication flow.

http://technet.microsoft.com/en-us/library/cc794918(v=ws.10).aspx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.