[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

DNS / Domain Trust Question

Posted on 2014-02-26
8
Medium Priority
?
545 Views
Last Modified: 2014-03-11
Afternoon all,

Hoping someone might be able to help me out with a couple of questions regarding and DNS issue I'm having.

Overview
Our company was bought out by another and we've just had our MPLS networks joined. Therefore I can ping their subnets and they can ping ours.
Our domain forest is 'company1.local' and theirs is 'company2.com.au'

I've created a conditional forwarder for 'company2.com.au' and added their 3 AD DNS servers.

I also need to create a 2-way trust between the AD forests and that works up until the point where I need a domain admin account for their domain (I cant go further as they gave there systems admin the week off)

ISSUE
Now we can log into their terminal servers if we use the IP of the server, however we dont have the IP for most of them, only the names.

The issue is, if try to RDP into say 'sfg-ts-001' or even try to ping that name it wont resolve.
If I use 'sfg-ts-001.company2.com.au' I can ping and RDP to it fine.

My question is what step did I miss for the reverse DNS to work between the sites so I can just use the server name instead of its full FQDN? Or will this not work properly till the 2way trust has been configured?

Thanks again
0
Comment
Question by:QuazzieM
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 664 total points
ID: 39890864
In order for you to use just the host name, sfg-ts-001, you would need to configure your PC to append that domain name.

I know you can do this via GPO, but I don't know how.

To manually do this you look at the IP V4 settings on your NIC.  Select Advanced and then the DNS tab.  At the bottom of that window you can add other DNS suffixes, just add company2.com.au there.
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 668 total points
ID: 39890878
It's in Computer Configuration>Policies>Administrative Templates>Network>DNS Client : DNS Suffix Search List.

Enable that, then enter your search order.  It probably wouldn't hurt to add your own suffix first.  Ordering is critical.

You may want to first enable and set the Primary DNS Suffix under DNS Client to guarantee your own workstations get the right primary.

Create a new GPO for this and link it to your domain.  Keep it separate from other policies for troubleshooting purposes.
0
 
LVL 8

Expert Comment

by:N-W
ID: 39890965
As Netman66 recommended, add their domain name to the DNS Suffix Search list (secondary to your local domain name). One caveat regarding this is that if both of your domains have a server with the same name, you will only connect to the local server.

For example, if you both have a server named "server01" and you want to connect to "server01" in the "company2.com.au" domain, you will still have to specify the full FQDN "server01.company2.com.au". Default name resolution for "server01" will be "server01.company1.local".
0
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

 
LVL 9

Assisted Solution

by:VirastaR
VirastaR earned 668 total points
ID: 39891746
Hi,

Just follow this step by step screenshots

Crossing Domain Boundaries: Name Resolution
http://www.olegsych.com/2009/04/crossing-domain-boundaries-name-resolution/

Hope that helps :)
0
 
LVL 27

Expert Comment

by:skullnobrains
ID: 39892829
you can also add the dns suffix in dhcp options if you use dhcp
0
 
LVL 38

Expert Comment

by:Mahesh
ID: 39892859
Try below

add host (A) records for opposite server names in your domain dns zone

for ex: domaina.com and domainb.com having trust
now you wanted to access server1.domainb.com from domaina.com as server1

So, just add new host record in domaina.com zone dns server pointing to its actual IP address, that's all. Just run ipconfig /flushdns once to flush cache
Now you could ping that as server1, it will resolve as server1.domaina.com
But now you can connect to that server with single label name to access through RDP, UNC paths as well

Mahesh
0
 
LVL 51

Expert Comment

by:Netman66
ID: 39892991
Don't do that.

Do it properly, rather than half-assed.

The DNS suffix from DHCP is for the primary suffix.  No need to set that via dhcp, there's no benefit.
0
 
LVL 27

Expert Comment

by:skullnobrains
ID: 39893266
i'm no windows expert but you are referring to dhcp option 15

DHCP option 119 configures the domain search list (mydomain.tld;myseconddomain.tld)

... but then i read that this option does not work with microsoft clients, though i'm unsure about that since it is indeed supported by the windows dhcp server. never tried myself.

---

going along @mahesh's proposal, it does not seem too dirty if you'd use cnames rather than A records (and if you can automate the task). you'll notice duplicate names along the way.

---

undoubtedly deploying the new dns suffix list through gpo is much better if feasible in your case

... and actually using fqdns even way better
0

Featured Post

Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question