Solved

one way trust

Posted on 2014-12-24
6
76 Views
Last Modified: 2015-01-17
Hi

I just setup a one way trust, what do I need to do to get users (Enterprise Admins) from the other domain to log into the domain controller in the other forest?
0
Comment
Question by:Jack_son_
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
6 Comments
 
LVL 17

Expert Comment

by:Tony Massa
ID: 40517295
Trusts grant no rights across trusting domains.  It only allows users to authenticate across domains.  You would have to add users to a group that grants the permissions that allow them to log on to domain controllers.  For example, add the users to "Account Operators", "Domain Admins", or "Enterprise Admins" (you should not do this, generally.)

If at all possible, never let "standard" user accounts log on to domain controllers or add them to sensitive groups.  Always require a secondary, administrative account for elevated access to domains/domain controllers.
0
 

Author Comment

by:Jack_son_
ID: 40521156
I can see the domain, although it will not allow me to see the users under the other domain.    Then when I rdp to the dc, it says the trust relationship failed.
0
 
LVL 27

Expert Comment

by:Steve
ID: 40521562
check you've got the trust the right way around.
0
Office 365 Training for IT Pros

Learn how to provision Office 365 tenants, synchronize your on-premise Active Directory, and implement Single Sign-On.

 
LVL 17

Expert Comment

by:Tony Massa
ID: 40523051
Remember, trust direction is opposite of access direction.
If you want DOMAIN-A users to log on to DOMAIN-B, then you need to set up an INCOMING trust on DOMAIN-A or an OUTGOING trust on DOMAIN-B.

http://technet.microsoft.com/en-us/library/cc794933%28v=ws.10%29.aspx

As totallytonto mentions, you likely have the trust direction going the wrong way.
0
 

Author Comment

by:Jack_son_
ID: 40524817
Actually it connected for a bit, but now it says it cant reach the controllers.  This is pingable between the locations.  Perhaps there are additional DNS settings beyond what i setup?
0
 
LVL 27

Accepted Solution

by:
Steve earned 500 total points
ID: 40531180
have you set the DNS forwarders for each domain's DNS servers so they can forward DNS requests for the other domain to the right DNS server?
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question