Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

how does work the authentication in a Forest Trust  ?

Posted on 2012-03-23
3
Medium Priority
?
618 Views
Last Modified: 2012-03-26
Hi Experts,
here is my pb :

I've got a Forest A (with only 1 domain, 2003 native mode), i've got another Forest B (with 1 root domain, and 20 child domains, 2003 native mode).

I opened network flow through Firewall to let communicate DCs from domain A and DCs from the root domain B .

So i was able to make a forest trust without problem.

I can add user from the root  B to groups of the domain A.

But now, if I want to add users from childs domains of the forest B to groups of domain A, i've got an error like " unable to communicate to the domain controller".

My question is : Should I open network flow between Forest 1 DCs and all DCs of the Forest B ? (included all childs domains DCs)
If yes, I can't understand where is the benefit to make a trust forest instead of multiple domains trusts.

Or maybe in my configuration i've to work with command line to manage AD ?


Thanks !
0
Comment
Question by:Carlito985
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 26

Assisted Solution

by:Leon Fester
Leon Fester earned 2000 total points
ID: 37756491
You should still open firewall rules to allow you DC's in your child domain to connect to the other forest.

While the forest trust allows you to setup only one trust for all your domain, each domain controller will do it's own authentication requests to the

This article should show you nicely how it works.
Check out the setions for
Trust Architecture
Trust Processes and Interactions

http://technet.microsoft.com/en-us/library/cc773178(v=ws.10).aspx
0
 
LVL 1

Author Comment

by:Carlito985
ID: 37756514
Thanks !
I understood, But with your comment, i don't understand the benefit of a shortcut trust, can you explain me ?
0
 
LVL 26

Accepted Solution

by:
Leon Fester earned 2000 total points
ID: 37756903
My statements is based on the understaning of how the trust hierarchy and authentication flow
works.

As soon as you introduce a shortcut trust you're essentially changing the authentication flow so that it no longer needs to traverse the trust hierachy.

A shortcut trust doesn’t give either domain access to anything new, but rather it just sorta introduces the two domains to each other. Once the shortcut trust is in place, the two domains can access each other directly without having to traverse the forest in an attempt to locate a domain controller.

Also remember, a shortcut trust can only be created between domains in the same forest.

Your multi-domain forest may be a good candidate for a shortcut trust if you have roaming users user who are complaining about the amount of time it takes for them to be authenticated.

Check out this article, it's not quite for your scenario, but it shows how shortcut trusts can be used to reduce/improve the authentication flow.

http://technet.microsoft.com/en-us/library/cc794918(v=ws.10).aspx
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question