Solved

how does work the authentication in a Forest Trust  ?

Posted on 2012-03-23
3
579 Views
Last Modified: 2012-03-26
Hi Experts,
here is my pb :

I've got a Forest A (with only 1 domain, 2003 native mode), i've got another Forest B (with 1 root domain, and 20 child domains, 2003 native mode).

I opened network flow through Firewall to let communicate DCs from domain A and DCs from the root domain B .

So i was able to make a forest trust without problem.

I can add user from the root  B to groups of the domain A.

But now, if I want to add users from childs domains of the forest B to groups of domain A, i've got an error like " unable to communicate to the domain controller".

My question is : Should I open network flow between Forest 1 DCs and all DCs of the Forest B ? (included all childs domains DCs)
If yes, I can't understand where is the benefit to make a trust forest instead of multiple domains trusts.

Or maybe in my configuration i've to work with command line to manage AD ?


Thanks !
0
Comment
Question by:Carlito985
  • 2
3 Comments
 
LVL 26

Assisted Solution

by:Leon Fester
Leon Fester earned 500 total points
ID: 37756491
You should still open firewall rules to allow you DC's in your child domain to connect to the other forest.

While the forest trust allows you to setup only one trust for all your domain, each domain controller will do it's own authentication requests to the

This article should show you nicely how it works.
Check out the setions for
Trust Architecture
Trust Processes and Interactions

http://technet.microsoft.com/en-us/library/cc773178(v=ws.10).aspx
0
 
LVL 1

Author Comment

by:Carlito985
ID: 37756514
Thanks !
I understood, But with your comment, i don't understand the benefit of a shortcut trust, can you explain me ?
0
 
LVL 26

Accepted Solution

by:
Leon Fester earned 500 total points
ID: 37756903
My statements is based on the understaning of how the trust hierarchy and authentication flow
works.

As soon as you introduce a shortcut trust you're essentially changing the authentication flow so that it no longer needs to traverse the trust hierachy.

A shortcut trust doesn’t give either domain access to anything new, but rather it just sorta introduces the two domains to each other. Once the shortcut trust is in place, the two domains can access each other directly without having to traverse the forest in an attempt to locate a domain controller.

Also remember, a shortcut trust can only be created between domains in the same forest.

Your multi-domain forest may be a good candidate for a shortcut trust if you have roaming users user who are complaining about the amount of time it takes for them to be authenticated.

Check out this article, it's not quite for your scenario, but it shows how shortcut trusts can be used to reduce/improve the authentication flow.

http://technet.microsoft.com/en-us/library/cc794918(v=ws.10).aspx
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now