Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

DNS / Domain Trust Question

Posted on 2014-02-26
8
Medium Priority
?
550 Views
Last Modified: 2014-03-11
Afternoon all,

Hoping someone might be able to help me out with a couple of questions regarding and DNS issue I'm having.

Overview
Our company was bought out by another and we've just had our MPLS networks joined. Therefore I can ping their subnets and they can ping ours.
Our domain forest is 'company1.local' and theirs is 'company2.com.au'

I've created a conditional forwarder for 'company2.com.au' and added their 3 AD DNS servers.

I also need to create a 2-way trust between the AD forests and that works up until the point where I need a domain admin account for their domain (I cant go further as they gave there systems admin the week off)

ISSUE
Now we can log into their terminal servers if we use the IP of the server, however we dont have the IP for most of them, only the names.

The issue is, if try to RDP into say 'sfg-ts-001' or even try to ping that name it wont resolve.
If I use 'sfg-ts-001.company2.com.au' I can ping and RDP to it fine.

My question is what step did I miss for the reverse DNS to work between the sites so I can just use the server name instead of its full FQDN? Or will this not work properly till the 2way trust has been configured?

Thanks again
0
Comment
Question by:QuazzieM
8 Comments
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 664 total points
ID: 39890864
In order for you to use just the host name, sfg-ts-001, you would need to configure your PC to append that domain name.

I know you can do this via GPO, but I don't know how.

To manually do this you look at the IP V4 settings on your NIC.  Select Advanced and then the DNS tab.  At the bottom of that window you can add other DNS suffixes, just add company2.com.au there.
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 668 total points
ID: 39890878
It's in Computer Configuration>Policies>Administrative Templates>Network>DNS Client : DNS Suffix Search List.

Enable that, then enter your search order.  It probably wouldn't hurt to add your own suffix first.  Ordering is critical.

You may want to first enable and set the Primary DNS Suffix under DNS Client to guarantee your own workstations get the right primary.

Create a new GPO for this and link it to your domain.  Keep it separate from other policies for troubleshooting purposes.
0
 
LVL 8

Expert Comment

by:N-W
ID: 39890965
As Netman66 recommended, add their domain name to the DNS Suffix Search list (secondary to your local domain name). One caveat regarding this is that if both of your domains have a server with the same name, you will only connect to the local server.

For example, if you both have a server named "server01" and you want to connect to "server01" in the "company2.com.au" domain, you will still have to specify the full FQDN "server01.company2.com.au". Default name resolution for "server01" will be "server01.company1.local".
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 9

Assisted Solution

by:VirastaR
VirastaR earned 668 total points
ID: 39891746
Hi,

Just follow this step by step screenshots

Crossing Domain Boundaries: Name Resolution
http://www.olegsych.com/2009/04/crossing-domain-boundaries-name-resolution/

Hope that helps :)
0
 
LVL 27

Expert Comment

by:skullnobrains
ID: 39892829
you can also add the dns suffix in dhcp options if you use dhcp
0
 
LVL 39

Expert Comment

by:Mahesh
ID: 39892859
Try below

add host (A) records for opposite server names in your domain dns zone

for ex: domaina.com and domainb.com having trust
now you wanted to access server1.domainb.com from domaina.com as server1

So, just add new host record in domaina.com zone dns server pointing to its actual IP address, that's all. Just run ipconfig /flushdns once to flush cache
Now you could ping that as server1, it will resolve as server1.domaina.com
But now you can connect to that server with single label name to access through RDP, UNC paths as well

Mahesh
0
 
LVL 51

Expert Comment

by:Netman66
ID: 39892991
Don't do that.

Do it properly, rather than half-assed.

The DNS suffix from DHCP is for the primary suffix.  No need to set that via dhcp, there's no benefit.
0
 
LVL 27

Expert Comment

by:skullnobrains
ID: 39893266
i'm no windows expert but you are referring to dhcp option 15

DHCP option 119 configures the domain search list (mydomain.tld;myseconddomain.tld)

... but then i read that this option does not work with microsoft clients, though i'm unsure about that since it is indeed supported by the windows dhcp server. never tried myself.

---

going along @mahesh's proposal, it does not seem too dirty if you'd use cnames rather than A records (and if you can automate the task). you'll notice duplicate names along the way.

---

undoubtedly deploying the new dns suffix list through gpo is much better if feasible in your case

... and actually using fqdns even way better
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
Sometimes it necessary to set special permissions on user objects.  For instance when using a Blackberry server, the SendAs permission needs to be set. I see many admins struggle with the setting that permission only to see it disappear within a few…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question