One way trust relationship between different domain windows server 2012 in different forest

I'd like to build trust correctly between the domains A.local and B.int. A.local is on a Windows 2012 . B.int is on a Windows 2012 . Both machines are
connected to the same LAN. The forest level in A.local
machine is Windows Server 2008 and The forest level in B.int
is Windows server 2012.
I want a one-way trust relationship, i.e. users from A.local gain access to B.local.
my problem it i create the trust put when i go to validate the trust between A.Local and B.int give me this error :
The secure channel (SC) reset on Active Directory Domain Controller \\dc2.B.int of domain B.int to domain A.Local failed with error: There are currently no logon servers available to service the logon request.
NOTE : Recently I
UPGRADE THE Active Directory FROM 2008 R2 TO 2012 and i ping on A.local to B.int
it is ping by name and IP but from b.int ping by IP JUST >>>
ihab

Hi,
yes i already do it the setup conditional forwarding between the 2 domains and
the firewall it is off
ihab

Similar Messages

2-way Trust Relationship between Windows and Mac Domain

Hi guys I hope someone can help me.
Just a quick explanation of what I am trying to do.
I have an Xserve running OSX 10.5.8 server, which is the OD Master. On that server I’m running Kerio mail server. I have a Microsoft 2003 server running AD.
The problem is I need to run BlackBerry Enterprise on the Windows server as the BlackBerry need active directory to work.
Since I have both system already running, I do not want to destroy my open directory just to get the BlackBerry working.
So what I have tried to do is create a 2-way Trust Relationship between the 2 domains, so the BlackBerry server will talk to the Kerio mail server.
The trust relationship appears to create fine from the Windows server side, but I’m not able to retrieve LDAP information from the open directory server.
The creation from the OSX server starts fine automated but then I had to finish it manually.
Has anyone else here created a 2-way trust relationship between Windows and Mac’s before? Any help on how you did it would be appreciated. Thanks

Have you checked on when the computer last checked in and changed the computer account password with the domain? When a computer changes it's password, Active Directory will store only the current password and it does not expire. The workstation
will store both the current password and the previous password. This for cases when you may restore Active Directory to a point before the computer password change.
To handle this, the workstation will try it's current password, then it's previous.
If you're restoring the workstation to a previous point in time, you may be rolling the stored passwords back too far for Active Directory to accept. I would only imagine this to be the case a handful of times if you're going back 1-2 days.
Are you experiencing 100% failure?

I have an error when join pc's to domain windows server 2012 r2

Hello everyone
I have a problem to join computers to the domain.
I'm doing the procedure is as follows.
1.'ll properties pc
2. I click Change to join the domain.
3. I request the domain administrator credentials
4. I get the window that has joined the domain correctly and then click accept gives me the following error:}
This error message me with all computers that attempt to join the domain.
I have reviewed forums, I have already set the WINS part and for the network adapter. Not if it's a problem with the server version domain is Windows Server 2012 R2.
I appreciate your help.
regards
Miguel Solano

Hello everyone
I have a problem to join computers to the domain.
Well I can not understand Spanish but I guess it is related to RPC. :D
In that case, you need to make sure your DNS entries are correct in clients NIC. Similar threads here:
"RPC Server Unavailable" while attempting to Join domain
Windows
Server Troubleshooting: "The RPC server is unavailable"
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Windows Server 2012 R2 - New Forest - Lowest forest fuctional level 2008

Hi,
I just setup a new win2k12 r2 forest. I notice the lowest forest functional level that I can select is only Windows Server 2008. How come 2003 is not on there when it is supported in the document below?
The following table shows the features that are available at each forest functional level.
http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx
Thanks

Windows Server 2003 is in extended support and even the extended support will end next year - So setting up Windows Server 2003 DCs in a brand new forest of this date doesn't make sense (or at least it's not what Microsoft want you to do)
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Why does my Cisco router firewall block Windows Server 2012 traffic, but not Windows Server 2008 traffic?

Hello,
   I run a small business network with five physical servers: three Dell servers running Windows Server 2008 R2, one custom build running 2008, and another custom build running 2012 with Domain Controller Role (same hardware for both custom builds).
The Dell servers are all running the Hyper-V role and each has a number of 2008 VMs. I also have a 2012 VM with the Domain Controller Role on one of the Hyper-V servers and another VM with a completely base install of 2012.
   All servers are plugged into a Cisco SG300-52 switch which is uplinked to a Cisco 881 router which is connected to a cable TWC provided Ubee cable modem. I have no VLANs setup. I do have the Firewall on the router configured
to inspect most traffic.
   Here is my problem: I cannot connect to most of the internet on ANY 2012 server (and all exhibit the exact same behavior), but I have NO problems connecting to the internet from 2008 servers. Here is what I already know:
   1.) I can ping the outside world just fine so ICMP is passing to any external host.
   2.) Two of the 2012 servers are DCs running DNS services and they can connect to the internet just fine for DNS requests because they are doing a perfectly good job of providing DNS services to my network.
   3.) Here's where it gets really weird: I can browse in internet explorer to Bing.com and it works. I can also go to a couple other Microsoft websites (though they are very slow). If I click on any link in Bing, however, it doesn't
work and gives me a page not available error. If I connect to a non-MS website like Google or my company website, I get page not available.
    4.) I have tried to telnet to port 80 at Bing and it works. I have tried to telnet to port 80 at google.com and it won't connect. The 2008 servers have no issue telneting to either bing or google on port 80 and none of my client
PCs on the network do either.
    5.) Windows Update will not connect and neither will any other update service such as AVG (I have AVG Antivirus installed WITHOUT firewall on two of the three servers. The base 2012 VM has no software installed and no roles...I built it
just to see if it could connect after a fresh install and it still cannot.)
    6.) The network connection does not indicate limited connectivity (probably because ICMP appears to be passing successfully)
     7.) If I connect the server directly to the modem it has full internet access.
     8.) All internal LAN connectivity is perfectly fine and runs at full speed.
     9.) I have scoured the internet trying to find other examples of this particular kind of connectivity issue on 2012 and I have found two TechNet articles that are similar, but they both had the same resolution: changing the router
worked, but no one knows why. (I would have included the links, but apparently I cannot do that yet)
My question is this: What is different about Windows Server 2012 networking that would render it unable to communicate through a router that Windows Server 2008 has no problems with? I ask because, unlike in these two articles where they were
running personal networking equipment they could easily upgrade, I'm running a Cisco 881 with what should be virtually limitless configuration options and I have no desire to replace it. I have to assume the issue is somehow related to the firewall configuration,
which I could fix easily, but I don't know what to change. If anyone knows what changed in 2012 and why I would be able to browse to bing and other MS sites but no where else, please pass them along. Thanks.

This is the IP Config for the 2012 DC:
Windows IP Configuration
   Host Name . . . . . . . . . . . . : COMPANYDC02
   Primary Dns Suffix . . . . . . . : company.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : company.local
Ethernet adapter Ethernet:
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Intel(R) 82574L Gigabit Network Connection
   Physical Address. . . . . . . . . : 00-25-90-DC-EF-D5
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::81d5:53cf:bd07:14ed%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.10.10.202(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.10.10.1
   DHCPv6 IAID . . . . . . . . . . . : 301999504
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-96-D5-C3-00-25-90-DC-EF-D5
   DNS Servers . . . . . . . . . . . : 10.10.10.202
                                       10.10.10.221
   NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.{9929D989-8E88-4096-A1CB-61F1DB173FA3}:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Teredo Tunneling Pseudo-Interface:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
This is the IP Config for the fresh install 2012 VM:
Windows IP Configuration
   Host Name . . . . . . . . . . . . : WIN-800299O7ES6
   Primary Dns Suffix . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : company.local
Ethernet adapter Ethernet:
   Connection-specific DNS Suffix . : company.local
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
   Physical Address. . . . . . . . . : 00-15-5D-0A-5C-02
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.10.10.49(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Saturday, August 23, 2014 10:23:01 PM
   Lease Expires . . . . . . . . . . : Wednesday, August 27, 2014 10:23:01 PM
   Default Gateway . . . . . . . . . : 10.10.10.1
   DHCP Server . . . . . . . . . . . : 10.10.10.1
   DNS Servers . . . . . . . . . . . : 10.10.10.220
                                       10.10.10.221
   NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.company.local:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . : company.local
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
NOTE: 10.10.10.220 and 10.10.10.221 are the other domain controllers on my network. One of them is 2012 and one of them is 2008. They are both functioning correctly for providing DNS services. The 2012 Virtual DC, however, still has
the internet connectivity issue that this whole post was about in the first place.
NOTE2: When I logged on to COMPANYDC02 this morning, it told me that I had new Windows Updates that needed to be downloaded.   Confused, I checked the most recent time WU had checked for updates at it had successfully checked for updates last night
at 10pm. Of course, it failed when trying to download them, but it appears that once in a while, a connection gets through successfully...

Users see all applications in RDS 2012 Web access in one-way trust domain environment

Hello!
We have RDS 2012 deployment in domainA.local. There is a one-way trust between domainA.local and domainB.local: A trusts B and B doesn't trust A.
A user from domainB.local authenticates in Web-access interface (wa.domainA.local) and sees
every published application in every collection in the deployment independently of UserGroups setting of collections and applications. This occurs for any domainB user.
In the security log of wa.domainA.local we can find an event :
An account failed to log on.
Subject:
Security ID:                IIS APPPOOL\RDWebAccess
Account Name:                RDWebAccess
Account Domain:                IIS APPPOOL
Logon ID:                0x2C7B16
Logon Type:                        3
Account For Which Logon Failed:
Security ID:                NULL SID
Account Name:
Account Domain:
Failure Information:
Failure Reason:                An error occurred during logon
Status:                        0xC000005E
Sub Status:                0x0
Also in network trace on wa.domainA.local kerberos error could be found:
On TGS-REQ for krbtgt/[email protected] there is an answer: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7), server name krbtgt/domainB.
How to deal with this issue? The aim is to show only specified applications to domainB users.
Any help would be appreciated.

Hi,
Thank you for your posting in Windows Server Forum.
Please check below links might useful for your case.
“After adding the RDS server’s computer account to the Builtin Windows Authorization Access Group domain group, the RemoteApp icons displayed perfectly.” (Quoted from
this article)
1. Remote APP list empty
2. RD
Web Access unable to access Source (RD Server)
In respect to Kerberos Error, refer this link for troubleshooting.
1. Troubleshooting Kerberos Authentication problems – Name resolution issues
2. Kerberos Authentication problems – Service Principal Name (SPN) issues - Part 2
Hope it helps!
Thanks,
Dharmesh

Active Directory: One Way Trust from NT Domain to 2003 Domain being upgraded to 2012 R2

We have an old legacy NT 4 domain that is slowly being decommissioned. (Slowly is the key word) Currently there is a one way External Trust between those NT 4 domains and a child domain that is at 2003 functionality. We are in the middle of upgrading
those child domain and the root domain to 2012 R2. My only concern right now and I can't seem to find concert proof either way, but will that external one way trust break when upgrading the forest and domain functionality to 2012 R2 once we
have all our DC's upgraded? I have read articles on how to get that trust to work in a 2008 R2 domain and of course it is working with the existing 2003 domain.
In theory the trust should break, correct? However, I know there are some security changes among other things in 2012 that may or may not work.
Kristopher Turner | Not the brightest bulb but by far not the dimmest bulb.

Yes. We are working with the client to migrate any dependencies off these 3 NT legacy domains. We will be able to decommission 2 of the 3 without any issues. However, they still have an old NT box running SQL 6.5 databases for a application still in
production. Yes, they are very aware that NT isn't supported, that that version of SQL isn't supported, and that this will hold up their upgrade.
Our plans for them will be to deploy all new Windows Server 2012 R2 domain controllers but keep the domain and the forest functionality at 2003 in order to support that final NT Legacy domain until they can get that application migrated.
Once that NT domain is decommissioned then we can raise the functionality of the rest of their domains from 2003 to 2012 R2.
Kristopher Turner | Not the brightest bulb but by far not the dimmest bulb.

Getting Error The trust relationship between the primary domain and the trusted domain failed in SharePoint 2010

Hi,
SharePoint 2010 Backup has been taken from production and restored through Semantic Tool in one of the server.The wepapplication of which the backup was taken is working fine.
But the problem is that the SharePoint is not working correctly.We cannot create any new webapplication ,cannot navigate to the ServiceApplications.aspx page it shows error.Even the Search and UserProfile Services of the existing Web Application is not working.Checking
the SharePoint Logs I found out the below exception
11/30/2011 12:14:53.78 WebAnalyticsService.exe (0x06D4)        0x2D24 SharePoint Foundation         Database
8u1d High    Flushing connection pool 'Data Source=urasvr139;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False;Connect Timeout=15'
11/30/2011 12:14:53.78 WebAnalyticsService.exe (0x06D4)        0x2D24 SharePoint Foundation         Topology
2myf Medium Enabling the configuration filesystem and memory caches.
11/30/2011 12:14:53.79 WebAnalyticsService.exe (0x06D4)        0x12AC SharePoint Foundation         Database
8u1d High    Flushing connection pool 'Data Source=urasvr139;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False;Connect Timeout=15'
11/30/2011 12:14:53.79 WebAnalyticsService.exe (0x06D4)        0x12AC SharePoint Foundation         Topology
2myf Medium Enabling the configuration filesystem and memory caches.
11/30/2011 12:14:55.54 mssearch.exe (0x0864)                   0x2B24 SharePoint Server Search      Propagation Manager
fo2s Medium [3b3-c-0 An] aborting all propagation tasks and propagation-owned transactions after waiting 300 seconds (0 indexes) [indexpropagator.cxx:1607] d:\office\source\search\native\ytrip\tripoli\propagation\indexpropagator.cxx
11/30/2011 12:14:55.99 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
75dz High    The SPPersistedObject with
Name User Profile Service Application, Id 9577a6aa-33ec-498e-b198-56651b53bf27, Parent 13e1ef7d-40c2-4bcb-906c-a080866ca9bd failed to initialize with the following error: System.SystemException: The trust relationship between the primary domain and the trusted
domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection sourceSids, Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection
sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()
at Microsoft.SharePoint.Administration.SPAcl`1.Add(String princip...
11/30/2011 12:14:55.99* OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
75dz High    ...alName, String displayName, Byte[] securityIdentifier, T grantRightsMask, T denyRightsMask)     at Microsoft.SharePoint.Administration.SPAcl`1..ctor(String persistedAcl)
at Microsoft.SharePoint.Administration.SPServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPPersistedObject.Initialize(ISPPersistedStoreProvider
persistedStoreProvider, Guid id, Guid parentId, String name, SPObjectStatus status, Int64 version, XmlDocument state)
11/30/2011 12:14:56.00 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
8xqx High    Exception in RefreshCache. Exception message :The trust relationship between the primary domain and the trusted domain failed.
11/30/2011 12:14:56.00 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Timer
2n2p Monitorable The following error occured while trying to initialize the timer: System.SystemException: The trust relationship between the primary domain and the trusted domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection
sourceSids, Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type
targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()     at Microsoft.SharePoint.Administration.SPAcl`1.Add(String principalName, String displayName, Byte[] securityIdentifier, T grantRightsMask,
T denyRightsMask)     at Microsoft.SharePoint.Administrati...
11/30/2011 12:14:56.00* OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Timer
2n2p Monitorable ...on.SPAcl`1..ctor(String persistedAcl)     at Microsoft.SharePoint.Administration.SPServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.OnDeserialization()
at Microsoft.SharePoint.Administration.SPPersistedObject.Initialize(ISPPersistedStoreProvider persistedStoreProvider, Guid id, Guid parentId, String name, SPObjectStatus status, Int64 version, XmlDocument state)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(Guid
id, Guid parentId, Guid type, String name, SPObjectStatus status, Byte[] versionBuffer, String xml)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(SqlDataReader dr)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.RefreshCache(Int64
currentVe...
Please guide me on the above issue ,this will be of great help
Thanks.

I have same error. Verified for trust , ports , cleaned up cache.. nothing has helped.
The problem is caused by User profile Synch Service:
UserProfileProperty_WCFLogging :: ProfilePropertyService.GetProfileProperties Exception: System.SystemException:
The trust relationship between the primary domain and the trusted domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection sourceSids,
Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type
targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()     at Microsoft.SharePoint.Administration.SPAcl`1.Add(String principalName, String displayName, SPIdentifierType identifierType, Byte[]
identifier, T grantRightsMask, T denyRigh...
08/23/2014 13:00:20.96*        w3wp.exe (0x2204)
        0x293C        SharePoint Portal Server              User Profiles
        eh0u        Unexpected        ...tsMask)     at Microsoft.SharePoint.Administration.SPAcl`1..ctor(String persistedAcl)
at Microsoft.Office.Server.Administration.UserProfileApplication.get_SerializedAdministratorAcl()     at Microsoft.Office.Server.Administration.UserProfileApplication.GetProperties()     at Microsoft.Office.Server.UserProfiles.ProfilePropertyService.GetProfileProperties()
Please let me know if you any solution found for this?
Regards,
Kunal

Cannot share documents with few users in one way trusted domain

Hello
I am running in a wiered issue. I setup people picker in SP 2013 foundation version to lookup the user from one way trusted domains after which I started getting all the users from that domain in my intranet. I can also share or modify the permission of
users being administrator. However when I try to add 2 specific users as site collection administrator or try sharing a document, I get error.
I can lookup their name but when I try changing their permission or share document with them, I get error. It's wiered because it is only with this two users. there is no difference from Active Directory point of view between these and other users. Please
help or suggest some trouble shooting steps.
Regards,
Hardik Bhilota.

Hi Hardik,
What was the error message when sharing documents with the two users?
Please also check the ULS log for detailed error message which is located at C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\LOGS.
What is the permission of the two users in SharePoint site? Can they access the site?
Please also run the two commands below to see if the issue still occurs:
First, on every front-end Web server on a farm run this command:
STSADM.exe -o setapppassword -password key
Second, on a front-end Web server run this command:
STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv domain:DnsName,user,password -url http:// webapp
Best regards.
Thanks
Victoria Xia
TechNet Community Support

Trust Relationship between PC and Domain broken\failed after System Restore

We are currently faced with a problem that every time we do a System Restore on our Windows 7 workstation, upon login attempt, we an login failed because the Trust Relationship between PC and Domain is broken.
As solution: we have to log in as a local admin, remove the workstation account from the domain, then re-add the workstation back to the domain.
Does anybody know if there is a hotfix for this or how we can bypass having to remove and re-add the workstation to the domain in order to login?

Have you checked on when the computer last checked in and changed the computer account password with the domain? When a computer changes it's password, Active Directory will store only the current password and it does not expire. The workstation
will store both the current password and the previous password. This for cases when you may restore Active Directory to a point before the computer password change.
To handle this, the workstation will try it's current password, then it's previous.
If you're restoring the workstation to a previous point in time, you may be rolling the stored passwords back too far for Active Directory to accept. I would only imagine this to be the case a handful of times if you're going back 1-2 days.
Are you experiencing 100% failure?

One way trust WMI issues - only on domain controllers

Hi all,
I'm having some interesting issues with attempting to setup remote monitoring via WMI from a trusted domain service account to some remote domains in our environment. There is a one way trust setup, and the service account has no problems with any client
machines, but gets rejected when attempting to query the domain controllers.
I've verified this is an issue both in our enterprise and production environment. I assumed it had something to do with the Domain Controller Security Policy and added the account in question to the following policies to no avail:
Act as part of the operating system
Log on as a batch job
Log on as a service
Replace a process level token
Now I'm beginning to suspect it's something to do with not being able to add the service account to the "domain admins" group, however I'd much rather a solution that didn't involve giving this account admin privileges at all.
I've given the account read permissions to /root/CIMv2 via the WMI control MMC snap-in, as well as DCOM remote enable and added it to the "Distributed COM Users" and "Performance Monitor Users" groups.
I'm fully out of ideas and my google-fu is failing. Anyone hit this before?

Hi,
Yes, you will need to know the credentials of the domain admin in the trusted domain.
You can try to use Get-WmiObject command, and input trusted domain administrator’s credentials, which should give you admin privileges.
Using the Get-WMiObject Cmdlet
http://technet.microsoft.com/en-us/library/ee176860.aspx
If you have problems of applying Powershell, please refer to Powershell forum below:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverpowershell&filter=alltypes&sort=lastpostdesc
Regards,
Amy

Sharepoint foundation 2013 "The trust relationship between this workstation and the primary domain failed"

Hi Sir/Madam,
I try to connect the sharepoint foundation 2013 server by remote desktop recently using domain account, but it show the error message that mentioned in the subject. I can login the server using local account. Do I need to disjoin
the domain then rejoin the domain? Will there be any risk if I do this?
My SharePoint environment as below:
Primary domain : abc.local (DC : windows server 2012 standard R2)
SharePoint : SharePoint foundation 2013 and SQL Standard 2012 installed on a single windows server 2012 standard (not R2, joined domain "abc.local)
I tried this on DC > active directory user and compouter >right click Sharepoint pc > click reset > reboot sharepoint server, reboot sharepoint server but still cannot login using AD account
I also tried netdom command and powershell command "Reset -ComputerMachinePassword" also failed to reset the password.
Please help to resolve my problem. Thanks
Jeffrey

Go to Control Panel -> System -> under Computer Name, Domain, click Change Settings. Click on the Change button, then re-type the domain in the NetBIOS or FQDN format, which ever it is currently not set to. This will force a soft-join to the domain.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Remote Management of Hyper-V Across One-Way Trust

In order to abstract our hardware from the platform, we would like to virtualize all of our physical machines, installing Hyper-V server and just running one VM on Hyper-V. We hope this will allow us to quickly migrate machines that currently cannot be on
our virtual environment for whatever reason.
We set up a management domain for all of the Hyper-V servers separate from our main domain. A one way trust was established between the main domain and the management domain, with the management domain trusting the main domain. On the management domain,
we created a domain local group, called Management Domain Admins, which contains the foreign security principals from the main domain. The Management Domain Admins group is added to the Hyper-V built in Administrators group.
Now here is the problem, from a workstation in the main domain, we can manage every part of that server except for adding a virtual hard disk. We can manage the firewall, we can look through the event log, we can create virtual machines and connect them
to existing virtual hard disks, but we cannot create a virtual hard disk. The log returns:
The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
We disabled the firewall on both the workstation and the server with the same result. Using a workstation WITHIN the management domain, logging in with an account from the main domain, we can create a virtual hard disk. We have also tried enabling anonymous
DCOM and adding the Hyper-V server to the Trusted Hosts list in WinRM to no avail. Also, using inline authentication, we can create virtual hard disks on the server BEFORE adding it to the domain. But as soon as it's added to the domain, we can no longer create
hard disks.
Appreciate any insight!

I hope it isn't the trust and it's something dumb I forgot to set. I checked again and "cscript .\hvremote.wsf /anondcom:grant" returns "INFO: Nothing to do - ANONYMOUS LOGON already has remote access"
Thanks!
The event is generate from DCOM, 10028
DCOM was unable to communicate with the computer <myserver> using any of the configured protocols; requested by PID a34 (C:\Windows\system32\mmc.exe).
The full trace is:
2013-07-24 07:59:24.988 [15] USER_ACTION_INITIATED Wizards NewVirtualHardDiskWizard:CreateVirtualHardDiskOnBackgroundThread() Creating new virtual hard disk ...
2013-07-24 07:59:24.997 [15] USER_ACTION_INITIATED VirtMan ImageManagementServiceView:BeginCreateVirtualHardDisk() Starting creating dynamic virtual hard disk 'D:\Hyper-V\Virtual Hard Disks\test.vhdx' (size = '136365211648')
2013-07-24 07:59:26.645 [15] ERROR Wizards VMWizardForm:PerformWizardActionInternal() Failed to perform wizard action!
The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementObject.Initialize(Boolean getObject)
at System.Management.ManagementBaseObject.get_wbemObject()
at System.Management.ManagementClass.CreateInstance()
at Microsoft.Virtualization.Client.Management.VirtualHardDiskSettingData.GetVirtualHardDiskSettingDataEmbeddedInstance(String serverName, String namespacePath)
at Microsoft.Virtualization.Client.Management.ImageManagementServiceView.BeginCreateVirtualHardDisk(VirtualHardDiskType type, VirtualHardDiskFormat format, String path, String parentPath, Int64 maxInternalSize)
at Microsoft.Virtualization.Client.Wizards.NewVhd.NewVirtualHardDiskWizard.CreateVirtualHardDiskOnBackgroundThread(Server server, VirtualHardDiskFormat hardDiskFormat, VirtualHardDiskType hardDiskType, String filePath, ConfigurationInfo configBase)
at Microsoft.Virtualization.Client.Wizards.NewVhd.NewVirtualHardDiskWizard.PerformWizardAction(Object stateObj)
at Microsoft.Virtualization.Client.Wizards.VMWizardForm.PerformWizardActionInternal(Object stateObj)
2013-07-24 07:59:26.754 [16] ERROR Wizards VMWizardForm:WizardActionFailed() Wizard action failed!
The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementObject.Initialize(Boolean getObject)
at System.Management.ManagementBaseObject.get_wbemObject()
at System.Management.ManagementClass.CreateInstance()
at Microsoft.Virtualization.Client.Management.VirtualHardDiskSettingData.GetVirtualHardDiskSettingDataEmbeddedInstance(String serverName, String namespacePath)
at Microsoft.Virtualization.Client.Management.ImageManagementServiceView.BeginCreateVirtualHardDisk(VirtualHardDiskType type, VirtualHardDiskFormat format, String path, String parentPath, Int64 maxInternalSize)
at Microsoft.Virtualization.Client.Wizards.NewVhd.NewVirtualHardDiskWizard.CreateVirtualHardDiskOnBackgroundThread(Server server, VirtualHardDiskFormat hardDiskFormat, VirtualHardDiskType hardDiskType, String filePath, ConfigurationInfo configBase)
at Microsoft.Virtualization.Client.Wizards.NewVhd.NewVirtualHardDiskWizard.PerformWizardAction(Object stateObj)
at Microsoft.Virtualization.Client.Wizards.VMWizardForm.PerformWizardActionInternal(Object stateObj)
2013-07-24 07:59:26.755 [16] ERROR Client InformationDisplayer:GetErrorInformationFromException() Application encountered a non-VirtMan exception! Not going to display non-localized message to user.
2013-07-24 07:59:26.756 [16] ERROR Client UnhandledExceptionHandler:HandleThreadExceptionInternal() Application encountered an unexpected exception!
The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementObject.Initialize(Boolean getObject)
at System.Management.ManagementBaseObject.get_wbemObject()
at System.Management.ManagementClass.CreateInstance()
at Microsoft.Virtualization.Client.Management.VirtualHardDiskSettingData.GetVirtualHardDiskSettingDataEmbeddedInstance(String serverName, String namespacePath)
at Microsoft.Virtualization.Client.Management.ImageManagementServiceView.BeginCreateVirtualHardDisk(VirtualHardDiskType type, VirtualHardDiskFormat format, String path, String parentPath, Int64 maxInternalSize)
at Microsoft.Virtualization.Client.Wizards.NewVhd.NewVirtualHardDiskWizard.CreateVirtualHardDiskOnBackgroundThread(Server server, VirtualHardDiskFormat hardDiskFormat, VirtualHardDiskType hardDiskType, String filePath, ConfigurationInfo configBase)
at Microsoft.Virtualization.Client.Wizards.NewVhd.NewVirtualHardDiskWizard.PerformWizardAction(Object stateObj)
at Microsoft.Virtualization.Client.Wizards.VMWizardForm.PerformWizardActionInternal(Object stateObj)

Trust relationship after upgrading to Windows 8.1

Hi
I have recently upgraded 20 laptops to Windows 8.1, lately some of the laptops keep saying trust relationship cannot contact to domain, I have taken them off the domain and then put them back on, the laptops then work again but each day with some laptops
the same thing happens again and I have to repeat the whole procedure. Recenlty the same laptop every day for the pass 5 days, it is really annoying and time consuming

Hi Carl Shorty,
What error message do you receive?
Do you means that the computer in error keeps losing the trust relationship every day?
This issue that machine trust cannot be established occurs because the computer's machine account has the incorrect role or its password has become mismatched with that of the domain database.
If we can login as local-admin , we join the domain from the client if at the same time you can provide an administrator username and password on the domain. We can delete the existing computer account in Server Manager, recreate the computer account, synchronize
the domain, and then on the client rejoin the domain.
For details, you can refer to: Trust Relationship Between Workstation and Domain Fails
http://support.microsoft.com/kb/162797
If this doesn’t work, we could use the command netdom reset 'machinename' /domain:'domainname
to reset the member security channel.
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

One Way Trust, Start with RWDC Then Go To RODC?

So, we have an internal network and a DMZ network in play here. I'm attempting to setup a one way trust so resources on the DMZ network can be managed from the internal network. Internal network has RWDCs in its domain, and the DMZ has its own
RWDCs in its own domain and a RODC from the internal network's domain. The internal network's RODC is in its own site in AD and is confirmed to be communicating with the RWDCs in the internal network. The RODC is not an authoritative DNS server,
but can host a secondary zone or stub zone. The functional level of the internal domain is 08r2 and the DMZ domain is 2012r2, if that matters.
The task is to setup the one way trust, and its proving a bit difficult. So far I've attempted both Conditional Forwarders or stub zones on the RODC and the DMZ RWDC, no dice. There are no observed DNS replication problems within the domains
themselves and using ping and nslookup, I've confirmed that DNS resolution is working between the RODC and the DMZ RWDC. When I try to create the trust from the DMZ RWDCs, it fails saying the specified domain cannot be contacted. Based on what
I've read online in other posts and my inability to get around it, it seems that a trust requires a RWDC at each end to function. If this is not the case, I would love to hear how it can be setup with a RWDC at one and and a RODC at the other.
Now, if its correct that the trust requires two RWDCs to setup, what if it was setup with two RWDCs and then one of the RWDCs was removed and replaced with a RODC? I guess what I'm asking is does it just require a RWDC at each end to be setup, or does
it also require a RWDC at each end for the trust to function properly on an ongoing basis?

Hi,
Sorry it takes me some time for testing and reply.
I've confirmed that it is fine to replace an RWDC to RODC after trusting is setup. You can set it in your environment.
If you have any feedback on our support, please send to [email protected]

One way trust relationship between different domain windows server 2012 in different forest

Similar Messages

Maybe you are looking for