Windows Server 2003 Trust Issues

[zeroomegazx]

Ok, you all here have been so helpful in the questions I've asked but I think this time I have a big puzzle for you all...

I am trying to setup trust relationships between multiple Active Directories here at work. Each AD is setup very simple. Their DNS is basically just setup by itself from the initial setup of the domains. Most of the AD's are on different subnets, I.E. 10.* to 198.*. Before when we had Windows NT 4.0 Server we didn't have an issue with the trusts. Ever since each domain has been converted to 2003 R2 we cannot get the domains to talk to each other, BUT they can ping each other.

Whats MORE interesting is that if I take 2 of the domain controllers, point their primary DNS at one another, I can make a trust relationship and it will stick until I change their primary DNS back to normal. I am very very confused as to what is going on or if I did something wrong in the upgrades. This is basically one of the last issues I have with our large upgrade.

Just for a little more information, each domain has about 20 people in it and they are all separate forests (something i plan on fixing down the road). So we have about 9 small domains I am trying to link together with trusts for now on different subnets. Any help is greatly appreciated!

[compass4]

I have'nt played with trust relationships much. But I would try setting up a DNS forwarder on each domains DNS to point to the other. Leaving the primary/secondary DNS settings alone on each box.

Maybe that would fix it?

[zeroomegazx]

I have'nt played with trust relationships much. But I would try setting up a DNS forwarder on each domains DNS to point to the other. Leaving the primary/secondary DNS settings alone on each box.

Maybe that would fix it?

Just gave it a quick try on 2 of the DC's with no luck, good idea though never would have thought of that, I really thought it was gonna work.

[+BudMan MVC]

Well your going to need to create an external trust with domains in different forests.. This should help

http://www.windowsnetworking.com/articles_...en-Forests.html

Creating Trusts Between Forests

But yeah your going to need name resolution to the other domains.

"The next step in preparing to create a forest level trust is that you must make sure that each forest’s root domain can see the root domain from the other forest. This means that you will have to create the necessary DNS records and use the NSLOOKUP command to make sure that you can resolve domain names in the other forest."

Without the details of how your dns is configured currently -- can not really give yout he details of what records you need to create.

But here this is part of the checklist for creating forest trusts

http://technet2.microsoft.com/windowsserve...3.mspx?mfr=true

Ensure that Domain Name System (DNS) is properly set up.

--

If there is a root DNS server that can be made the root DNS server for both of the forest DNS namespaces, then make it the root server by ensuring that the root zone contains delegations for each of the DNS namespaces. Also, update the root hints of all DNS servers with the new root DNS server.

If there is no shared root DNS server, and the root DNS servers for each forest DNS namespace are running a member of the Windows Server 2003 family, then configure DNS conditional forwarders in each DNS namespace to route queries for names in the other namespace.

If there is no shared root DNS server, and the root DNS servers for each forest DNS namespace are not running a member of the Windows Server 2003 family, then configure DNS secondary zones in each DNS namespace to route queries for names in the other namespace.

--

What are you current namespaces? Your going to have some issues I do believe -- if you namespaces are the same, yet different forests.

[bobbba]

whether or not it fixes your problem(and it may) I would look to implement the following:

Setup conditional forwarders for each domain on each DNS server

confirm name resolution between the domains

implement forest trusts between the domains

if it doesn't work post the error message

also, use the help file that comes with the mmc, it gives you loads of info

[+BudMan MVC]

If the namespace is different, ie

domainA.lan

DomainB.lan

etc..

then you should just need NS entries for the other domains added to the other dns. Sure you could do it with a conditional forward, but it would be just as easy to add NS records for the domains in question.

[zeroomegazx]

thanks a bunch guys I will give those a look over this afternoon and let you know how they turn out. Hopefully I'll be back with good news, or error reports =P

[zeroomegazx]

If the namespace is different, ie

domainA.lan

DomainB.lan

etc..

then you should just need NS entries for the other domains added to the other dns. Sure you could do it with a conditional forward, but it would be just as easy to add NS records for the domains in question.

Can you give me an example of the NS entry I would need to enter?

What is very odd is that I can ping by name, the 2 servers, but when I go to create the trust I receive the message that it cannot locate the domain controller in the specified domain.

[+BudMan MVC]

An what are namespaces? As to pinging them -- depending on your network, you could just be broadcasting for the host name, or just using wins to resolve?

Does it return a FQDN, ie server.domaina.lan or just server

What are your namespaces?? domaina.lan what?

[zeroomegazx]

An what are namespaces? As to pinging them -- depending on your network, you could just be broadcasting for the host name, or just using wins to resolve?

Does it return a FQDN, ie server.domaina.lan or just server

What are your namespaces?? domaina.lan what?

Sorry I disappeared, had a crash at the facility next door, I've been working on it for a while. We have WINS enabled on the main PDC's for each domain. Sometimes pinging will resolve an FQDN, if it is from a computer in its own domain. We do have one domain where it will not even return that for some reason, the computers on that domain log in fine (fast) but when I try to remotely authenticate to fix things on their computers I sometimes get a *no logon servers are available to process your request* yada yada. Is it safe to post namespaces here or should I PM you them?

[bobbba]

Is it safe to post namespaces here or should I PM you them?

Just swap them to hide the real domain names

i.e

domaina

domainb

etc

[zeroomegazx]

Just swap them to hide the real domain names

i.e

domaina

domainb

etc

Ok well this is the best way i can put it:

Domain 1 (which we would like to end up master): a.domain1.b.c.d.e IP scheme 10.*

Domain 2: Domain2.domain1.a.b.c IP Scheme 192.*

the letters indicate suffixes that are the same in both domains, the domain names suffixes are the only differences. This was setup BEFORE i got here heh.