Solved

DNS / Domain Trust Question

Posted on 2014-02-26
8
531 Views
Last Modified: 2014-03-11
Afternoon all,

Hoping someone might be able to help me out with a couple of questions regarding and DNS issue I'm having.

Overview
Our company was bought out by another and we've just had our MPLS networks joined. Therefore I can ping their subnets and they can ping ours.
Our domain forest is 'company1.local' and theirs is 'company2.com.au'

I've created a conditional forwarder for 'company2.com.au' and added their 3 AD DNS servers.

I also need to create a 2-way trust between the AD forests and that works up until the point where I need a domain admin account for their domain (I cant go further as they gave there systems admin the week off)

ISSUE
Now we can log into their terminal servers if we use the IP of the server, however we dont have the IP for most of them, only the names.

The issue is, if try to RDP into say 'sfg-ts-001' or even try to ping that name it wont resolve.
If I use 'sfg-ts-001.company2.com.au' I can ping and RDP to it fine.

My question is what step did I miss for the reverse DNS to work between the sites so I can just use the server name instead of its full FQDN? Or will this not work properly till the 2way trust has been configured?

Thanks again
0
Comment
Question by:QuazzieM
8 Comments
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 166 total points
ID: 39890864
In order for you to use just the host name, sfg-ts-001, you would need to configure your PC to append that domain name.

I know you can do this via GPO, but I don't know how.

To manually do this you look at the IP V4 settings on your NIC.  Select Advanced and then the DNS tab.  At the bottom of that window you can add other DNS suffixes, just add company2.com.au there.
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 167 total points
ID: 39890878
It's in Computer Configuration>Policies>Administrative Templates>Network>DNS Client : DNS Suffix Search List.

Enable that, then enter your search order.  It probably wouldn't hurt to add your own suffix first.  Ordering is critical.

You may want to first enable and set the Primary DNS Suffix under DNS Client to guarantee your own workstations get the right primary.

Create a new GPO for this and link it to your domain.  Keep it separate from other policies for troubleshooting purposes.
0
 
LVL 8

Expert Comment

by:N-W
ID: 39890965
As Netman66 recommended, add their domain name to the DNS Suffix Search list (secondary to your local domain name). One caveat regarding this is that if both of your domains have a server with the same name, you will only connect to the local server.

For example, if you both have a server named "server01" and you want to connect to "server01" in the "company2.com.au" domain, you will still have to specify the full FQDN "server01.company2.com.au". Default name resolution for "server01" will be "server01.company1.local".
0
Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

 
LVL 9

Assisted Solution

by:VirastaR
VirastaR earned 167 total points
ID: 39891746
Hi,

Just follow this step by step screenshots

Crossing Domain Boundaries: Name Resolution
http://www.olegsych.com/2009/04/crossing-domain-boundaries-name-resolution/

Hope that helps :)
0
 
LVL 27

Expert Comment

by:skullnobrains
ID: 39892829
you can also add the dns suffix in dhcp options if you use dhcp
0
 
LVL 37

Expert Comment

by:Mahesh
ID: 39892859
Try below

add host (A) records for opposite server names in your domain dns zone

for ex: domaina.com and domainb.com having trust
now you wanted to access server1.domainb.com from domaina.com as server1

So, just add new host record in domaina.com zone dns server pointing to its actual IP address, that's all. Just run ipconfig /flushdns once to flush cache
Now you could ping that as server1, it will resolve as server1.domaina.com
But now you can connect to that server with single label name to access through RDP, UNC paths as well

Mahesh
0
 
LVL 51

Expert Comment

by:Netman66
ID: 39892991
Don't do that.

Do it properly, rather than half-assed.

The DNS suffix from DHCP is for the primary suffix.  No need to set that via dhcp, there's no benefit.
0
 
LVL 27

Expert Comment

by:skullnobrains
ID: 39893266
i'm no windows expert but you are referring to dhcp option 15

DHCP option 119 configures the domain search list (mydomain.tld;myseconddomain.tld)

... but then i read that this option does not work with microsoft clients, though i'm unsure about that since it is indeed supported by the windows dhcp server. never tried myself.

---

going along @mahesh's proposal, it does not seem too dirty if you'd use cnames rather than A records (and if you can automate the task). you'll notice duplicate names along the way.

---

undoubtedly deploying the new dns suffix list through gpo is much better if feasible in your case

... and actually using fqdns even way better
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question