Solved

DNS / Domain Trust Question

Posted on 2014-02-26
8
513 Views
Last Modified: 2014-03-11
Afternoon all,

Hoping someone might be able to help me out with a couple of questions regarding and DNS issue I'm having.

Overview
Our company was bought out by another and we've just had our MPLS networks joined. Therefore I can ping their subnets and they can ping ours.
Our domain forest is 'company1.local' and theirs is 'company2.com.au'

I've created a conditional forwarder for 'company2.com.au' and added their 3 AD DNS servers.

I also need to create a 2-way trust between the AD forests and that works up until the point where I need a domain admin account for their domain (I cant go further as they gave there systems admin the week off)

ISSUE
Now we can log into their terminal servers if we use the IP of the server, however we dont have the IP for most of them, only the names.

The issue is, if try to RDP into say 'sfg-ts-001' or even try to ping that name it wont resolve.
If I use 'sfg-ts-001.company2.com.au' I can ping and RDP to it fine.

My question is what step did I miss for the reverse DNS to work between the sites so I can just use the server name instead of its full FQDN? Or will this not work properly till the 2way trust has been configured?

Thanks again
0
Comment
Question by:QuazzieM
8 Comments
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 166 total points
Comment Utility
In order for you to use just the host name, sfg-ts-001, you would need to configure your PC to append that domain name.

I know you can do this via GPO, but I don't know how.

To manually do this you look at the IP V4 settings on your NIC.  Select Advanced and then the DNS tab.  At the bottom of that window you can add other DNS suffixes, just add company2.com.au there.
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 167 total points
Comment Utility
It's in Computer Configuration>Policies>Administrative Templates>Network>DNS Client : DNS Suffix Search List.

Enable that, then enter your search order.  It probably wouldn't hurt to add your own suffix first.  Ordering is critical.

You may want to first enable and set the Primary DNS Suffix under DNS Client to guarantee your own workstations get the right primary.

Create a new GPO for this and link it to your domain.  Keep it separate from other policies for troubleshooting purposes.
0
 
LVL 8

Expert Comment

by:N-W
Comment Utility
As Netman66 recommended, add their domain name to the DNS Suffix Search list (secondary to your local domain name). One caveat regarding this is that if both of your domains have a server with the same name, you will only connect to the local server.

For example, if you both have a server named "server01" and you want to connect to "server01" in the "company2.com.au" domain, you will still have to specify the full FQDN "server01.company2.com.au". Default name resolution for "server01" will be "server01.company1.local".
0
 
LVL 9

Assisted Solution

by:VirastaR
VirastaR earned 167 total points
Comment Utility
Hi,

Just follow this step by step screenshots

Crossing Domain Boundaries: Name Resolution
http://www.olegsych.com/2009/04/crossing-domain-boundaries-name-resolution/

Hope that helps :)
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 26

Expert Comment

by:skullnobrains
Comment Utility
you can also add the dns suffix in dhcp options if you use dhcp
0
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
Try below

add host (A) records for opposite server names in your domain dns zone

for ex: domaina.com and domainb.com having trust
now you wanted to access server1.domainb.com from domaina.com as server1

So, just add new host record in domaina.com zone dns server pointing to its actual IP address, that's all. Just run ipconfig /flushdns once to flush cache
Now you could ping that as server1, it will resolve as server1.domaina.com
But now you can connect to that server with single label name to access through RDP, UNC paths as well

Mahesh
0
 
LVL 51

Expert Comment

by:Netman66
Comment Utility
Don't do that.

Do it properly, rather than half-assed.

The DNS suffix from DHCP is for the primary suffix.  No need to set that via dhcp, there's no benefit.
0
 
LVL 26

Expert Comment

by:skullnobrains
Comment Utility
i'm no windows expert but you are referring to dhcp option 15

DHCP option 119 configures the domain search list (mydomain.tld;myseconddomain.tld)

... but then i read that this option does not work with microsoft clients, though i'm unsure about that since it is indeed supported by the windows dhcp server. never tried myself.

---

going along @mahesh's proposal, it does not seem too dirty if you'd use cnames rather than A records (and if you can automate the task). you'll notice duplicate names along the way.

---

undoubtedly deploying the new dns suffix list through gpo is much better if feasible in your case

... and actually using fqdns even way better
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

I wrote this article to explain some important DNS concepts that should be known to avoid some typical configuration errors I often see in forums. I assume that what is described here is the typical behavior of Microsoft DNS client. I don't know …
I've written instructions for one router type, but this principle may be useful for others of the same brand and even other brands of router. Problem: I had an issue especially with mobile devices that refused to use DNS information supplied via…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now