Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 117
  • Last Modified:

Domain and trust between two domains but list users only from one side.

Drawing1.jpg1.PNG2.PNG3.PNGHello Experts ,
I have a problem with the domain and trust relationship between two different domains as you can see in drawing1.jpg >> we did trust between domain A and domain B  and it's successfully created >> Domain "A" has multiple sites >> domain B has one site ..The problem is when we list the resources "Users ,computers..etc " of domain B from Domain A it's listing them but it did not list users,computers of domain A from domain B and it asks you to enter user name and password ,when you enter any Enterprise admin of domain A or domain B it shows to you "Access is denied " and images number 1,2,3 logged in the event viewer
Please bear in mind the following items
1-Stub zone created on both domains.
2-we did the same configurations in new domain"test.com " in the same physical location as domain A  <<we did Trust between Domain B and Test .com and it worked fine "listing the resources  " from both sides.
3-VMware Tools has been removed from all servers.
4-Firewall is off on both domains.
5-subnets crated for all sites.
6-They have the same forest and domain functional level 2003.
7-Domain A has windows server 2003 and domain B windows server 2008.

Please advise about this issue..Thanks.
0
Mahmoud Noubani
Asked:
Mahmoud Noubani
  • 3
  • 2
  • 2
  • +2
1 Solution
 
David Johnson, CD, MVPOwnerCommented:
break / remove your trust and then create a 2 way transitive trust again
0
 
Mahmoud NoubaniAuthor Commented:
Hello david ;
Thanks for your reply I did that many times and created forest ;transitive ;one way trust incoming ;and one outgoing with the same results "error message "
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
It seems to be an authentication permission issue. Have you verified the domain B has proper authentication permission in Domain A?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Mahmoud NoubaniAuthor Commented:
Yes Zacharia,
We use Domain admin user of domain A and domain B ,enterprise admin of A and B also.
0
 
Abduljalil Abou AlzahabInfrastructure Team Leader – Professional ServicesCommented:
What is the Domain Function Level and Forest Function Level for domain B ?
0
 
Aaron TomoskyTechnology ConsultantCommented:
according to this:
http://technet.microsoft.com/en-us/library/cc816810%28v=ws.10%29.aspx

you have to do some DNS magic, have you done one of these options?
To create a forest trust successfully, you must set up your Domain Name System (DNS) environment properly. If there is a root DNS server that you can make the root DNS server for the DNS namespaces of both forests, make it the root DNS server by ensuring that the root zone contains delegations for each of the DNS namespaces. Also, update the root hints of all DNS servers with the new root DNS server.

If there is no shared root DNS server and the root DNS servers for each forest DNS namespace are running Windows Server 2003, configure DNS conditional forwarders in each DNS namespace to route queries for names in the other namespace.

If there is no shared root DNS server and the root DNS servers for each forest DNS namespace are not running Windows Server 2008 or Windows Server 2003, configure DNS secondary zones in each DNS namespace to route queries for names in the other namespace. For more information about configuring DNS to work with Active Directory Domain Services (AD DS), see the DNS Support for Active Directory Technical Reference (http://go.microsoft.com/fwlink/?LinkID=106660).
0
 
Abduljalil Abou AlzahabInfrastructure Team Leader – Professional ServicesCommented:
Hello,
Also to create a forest trust, the minimum forest functional level for the forests that are involved in the trust relationship is Windows Server 2003.

For more information about trust requirements:
http://technet.microsoft.com/en-us/library/cc816810(v=ws.10).aspx
0
 
Aaron TomoskyTechnology ConsultantCommented:
Abduljalil, the information in both of your last 2 comments is already in the original question.
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
The problem is when we list the resources "Users ,computers..etc " of domain B from Domain A it's listing them but it did not list users,computers of domain A from domain B

What kind of trust have you created? Could you please give  more details?

Are you sure that the  "DNS"  records are been populated properly in your forests?

Did you make sure the domain admins have proper authentications rights  on each forest?
0
 
Zacharia KurianAdministrator- Data Center & NetworkCommented:
Just for you clarification with regard to the trusts please have a look into the below link.

http://www.edwardsd.co.uk/work/2012/02/domain-trusts-guide/

I believe that you have created only "one way trust" which allows you only to access Domain B from Domain A. Is this your requirement or do you want to have access vise versa?
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 3
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now