Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 246
  • Last Modified:

Creating a Two AD Domain Trust

Hi Experts,

I am in the process of creating a project plan to create a two AD Trust between two domains.

One domain is running AD 2003 Functional/Forest levels and the other is running Windows 2008 R2 Functional/Forest levels.

Can you recommended the best practice/procedure to accomplish this project?

Should I use a stub DNS Zone vs a Conditional Forwarder etc.

Thanks
0
Teavana
Asked:
Teavana
  • 4
  • 3
1 Solution
 
Vipin VasudevanAssociate Infrastructure SpecialistCommented:
It is depend on need, if you need this trust to be keep for a long running cause, I will recommend using stub zone since that keep updated with any NS changes cross forest.

if this is short term trust such as part of migration best suit is Conditional forwarder

You may see other best practices on below KB
http://technet.microsoft.com/en-us/library/cc778033(v=ws.10).aspx
0
 
TeavanaAuthor Commented:
Thank you for your response, I will check the suggested link and report back.
0
 
TeavanaAuthor Commented:
VipinV,

I was able to successfully created the two way trust between the domains.  I have a security group in domain A that I need to add some users from domain B.

The security group that is in domain A is a Global group. When I tried to add users from domain B to domain A, I do not see the option to change to domain B location.

Any thoughts  on what I am missing ?   Thanks
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
Vipin VasudevanAssociate Infrastructure SpecialistCommented:
Hope you need to add users from Domain A to provide permission on Domain B. I recommend change the Group scope to Domain Local.
0
 
TeavanaAuthor Commented:
I do not follow ??
0
 
Vipin VasudevanAssociate Infrastructure SpecialistCommented:
You have mentioned "The security group that is in domain A is a Global group", you may change group type to Universal then to Domain Local group, since you may not able to convert this directly in to Domain Local group
0
 
TeavanaAuthor Commented:
Got it. this worked for me. I appreciate your help.
0

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now