We have Two untrusted forests separated by firewalls. we will install sccm site in forest A. we will also install management point and distribution point in the forest B. system discovery doundary groups are all clear. my question is related to client deployment and DNS
1. Is it required to open ports between sccm site server in forest A to all client computers in forest B. we will have a MP/DP in forest B. for client push I believe sccm site server needs to communicate with all the clients in forest B. this is a issue for us. instead can we deploy the agent using Group policy and close ports between clients in forest B to sccm site server.
2. as there has to be name resolution between the forests we are planning ro use conditional forwarders. but conditional forwarders will allow all users to resolve names in domain A. this is an issue. can we use anything else like a host file for name resolution.
we want clients in forest B only talk to mp/dp installed in the forest. we do not want to open ports between clients in forest B to sccm site server in forest A.