Trust between domains in different functional levels

Hi there,

I would like to set up a trust between two domains. Problem I have is one of them is pretty old. It has a Windows 2000 Mixed Functional level, and the other domain is 2008 functional level.

Will a unidirectional trust work? (2008 trusts 2000 mixed mode) or am I forced to rise the functional level?

I basically want my users in the old domain to be able to login (via RDP) into the machines in the new domain, but not the other way round.

Kind regards.
jimbobrocksAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

unknown_routineCommented:
You have to  update you domain functional level to Windows 2000 native mode.
0
Will SzymkowskiSenior Solution ArchitectCommented:
Is this 2 different Forest's you are creating the trust for or are you dealing with a single Forest 2 domains?

If it is 2 Forest's you should be able to create an "external trust" (non-transitive) and the mode needs to be in Native mode.


Will.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jimbobrocksAuthor Commented:
It would be two separated forest, and non-transitive trust. So users in win2000 domain can login into win2008 domain but not the other way round.

So it seems I need to upgrade to windows 2000 native mode. We don't have NT4 DCs anymore (actually not even 2000 DCs only 2003 DCs) so I guess this should be quite straight forward process isn't it?

Regards.
0
Will SzymkowskiSenior Solution ArchitectCommented:
That is correct. If you dont plan on having anymore 2000 DC's in your environment or any sub domain in that forest, you can also upgrade the forest functional level as well as the Domain.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.