OSD Across a Non-Trusted Domain

Hello All,
Thank you in advance for the help. I am trying to validate a configuration I would like to put in place for a client.
The client has Configuration Manager 2012 set up to manage computers in a non-trusted domain with no MPs in the non-trusted domain. There are DPs in the non-trusted domain. The site runs in an https configuration for these clients. We have configured a subordinate
CA in their forest that trusts the CA in the forest that hosts the ConfigMgr site servers and all certs are working fine.
My question: Will OSD function correctly for computers in the non-trusted domain? Or so I need to have an MP in the non-trusted domain as well?
Thanks!

Hi Jason,
Yes, you are correct - there are multiple HTTP MPs that are reachable from the non-trusted forest's computers on the Intranet. There is also an HTTPS MP in the DMZ which is reachable from the internal network as well (we use split-brain DNS for this). The
DMZ MP in HTTPS mode can handle the requests from the non-trusted forest's clients and I envision DPs being configured in the non-trusted forest's domain in HTTPS mode to provide the DP service for the non-trusted domain's clients.
One of the other respondants indicated that they believed this config would work as long as the client could reach a PXE enabled DP. I don't see a reason this won't work as well with a boot image with a cert on it or via Software Center, right?
Does this configuration sound kosher?
Thank you!

Similar Messages

Documentation on settings up DP, MP in non trusted domain USING HTTPS

Is there any documentation that specifically talks about setting up a site system in a non trusted domain with management point and distribution point and communication using HTTPS.
I see some examples but none of them talk about the certificates that are required on the DP and MP in the non trusted site server.
Thanks Lance

Hi Jason,
I am stumped (and not a certificate guru) and not sure how to get certs based on the Config Manager Web Server template and Config Manager Distribution Client Template into the machine (Secondary MP/DP) that is in the untrusted domain. I hear
you about the untrusted domain part not making a difference. Our secondary MP/DP in the untrusted domain does have the root certificate in the trust root store.
I have tried MMC certificates, certreq and have tried to go directly to the CA (https://caserver/certsrv) but in neither case do the Config Manager Distribution Client nor Config Manager Web Server templates show up.
Conversely in the domain that the CA Server resides, I can request both of these certs in the MMC certificate plugin.
I am certain I am missing something.
We used this technet document to setup the certificate templates, etc.
http://technet.microsoft.com/en-us/library/gg682023.aspx
Thanks Lance

Distribution/management point in non trusted domain

Hoping somebody can clarify a stituation for us on distribution points on a machine in a non trusted domain.
We are assuming that this distribution point uses the same certicate that the primary distribution point uses.
Is this correct? When we try this it says that certicate is already in use and do we want to continue.
Thanks in advance.
Thanks Lance

Hi,
Please configuring CEP/CES web service and the following blog is for your reference.
https://blogs.technet.com/b/askds/archive/2010/05/25/enabling-cep-and-ces-for-enrolling-non-domain-joined-computers-for-certificates.aspx
Best Regards,
Joyce Li
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Gateway server in non trusted domain

I have been trying to monitor a non trusted domain from SCOM 2012 R2. All servers are running Server 2012 R2 and this is running in a home lab.
I have added the trusted root certificate to both the gateway server and the SCOM management server.
SCOM Management Server is OM01.Corp.ViaMonstra.Com.
Gateway Server is BMC-DC01.BMC.Intern.
Both of these servers have the trusted root cert for ViaMonstraRootCA.
I then created a OpsMgr certificate by copying the ipsec(offline request) and making a new template. This has server and client authentication.
I requested this on both the gateway server and the management server and exported it from the user store and into the local computer store (with the private key).
I also ran MOMCERTIMPORT on both servers, only one cert showed up on each server which was the one I created and imported into the personal area of the local computer store.
I have checked that the FQDN name of the management server appears in the required opsmanager registry keys and also the required tls2.1 keys are in place.
I have also run the gateway approval tool which can with success and installed the gateway server role using the opsmgr install media.
I see the event 20053 stating the opsmgr connector has loaded the specified authentication certificate succesfully.
Yet I will get the events 20057,21001,20071,21016
Any ideas what else I can try?

Try these -
1)
http://social.technet.microsoft.com/Forums/ie/en-US/e478b734-b631-4daa-a752-e4557ad21fd7/gateway-unable-to-connect-to-management-server?forum=operationsmanagergeneral
2)
http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&lc=en&docname=c03381439
3)
http://www2.wolzak.com/index.php/news-mainmenu-2/10-opsmanager/15-the-opsmgr-connector-could-not-connect-to-msomhsvcrms01local
4)
http://www.assemblein.info/system-center/steps-to-resolve-scom-2012-gateway-server-error-unmonitored-state/
Thanks, S K Agrawal

By default, which right has a user on a "external trusted" domain ?

Hi,
I would like to know what are the rights for users in DomA when a bidirectionnal external trust is in place with DomB ?
By default, the user in DomA is member of "DomB\Domain User" (otherwise, how can the user in DomA can list the users in DomB for example ?)
Is there any specifics things to know if DomB is in Win2000 compatibility domain/forest level ?
I know this ressource
https://technet.microsoft.com/en-us/library/cc755321%28v=ws.10%29.aspx and this
https://technet.microsoft.com/en-us/library/cc757352(v=ws.10).aspx but didn't find my answer.
Thank you ! :)

I've created many trusts in my day and they can get confusing... quickly...
#1 Who is the "trusting Domain" (who is saying "yeah I, domA, will let DomB in the door")
#2 Who is the "trusted domain" (who is "walking through the door (DomB)")
*** I know you said "bidirectional" but it helps you visualize the "security trust" for what is actually required. **
#3 Is that "Domain User" part of a Group? Is the Group Domain or Universal? Only certain types of groups can work across a trust.
#4 Are you doing a domain level trust or a forest level trust? External trusts are "domain to domain". However the domains can exist in separate, non-related forests.
If you do a two-way domain External trust -- Domain Users from DomA can access all the resources on DomB, if explicitly provided they have access to those resources. What I mean by that is if Domain User Doesn't have domain admin privileges in DomA, it won't
get domain admin privileges to DomB and vice versa.
This is where the trick is though. In a two-way domain External Trust -- All domain / enterprise admins in DomA will have domain /enterprise admin access in DomB and vice versa. They can grant themselves privileges to any servers and resources.
This is why one way trusts are popular...because you only want to let one domain into the other domain. "big brother" type of trust.
Kind of make sense?
Entrepreneur, Strategic Technical Advisor, and Sr. Consulting Engineer - Strategic Services and Solutions Check out my book - Powershell 3.0 - WMI: http://amzn.to/1BnjOmo | Mastering PowerShell Coming in April 2015!

Add non-AD Domain

We have exchange setup for our AD domain. We have some non-AD domains that we need to accept mail on using exchange 2013. How do i set this up in exchange 2013?
I have added these domains in accepted domains but when i try to add users, i can only select from the AD domain.

If you want to add users from different domain to the exchange server then you need to create trust between those domain.
If you want have email address of non-domain user then create email address policy and add the accepted domain that you have created.
This will fulfil of stamping of exchange smtp address for the user account.
But if you want a mailbox for those non -domain (e.g user located in novel or linux) then you need to manually import the user list to the Active Directory console then you add them in Exchange server for mailbox created.
If you want to have the only the UPN suffix name of non domain then add the addtional upn suffix in the active directory console.
Exchange Queries

Network challenge - trusted domains

Within my organization, I have two domains A and B. There is a Classic ASP web intranet application hosted in an IIS server
in Domain B (Windows Authentication enabled, all other authentication modes disabled). As for as I know, A and B is
in a Domain Trust relationship.
The problem here is, when users logged in to Domain A try to access the web application mentioned above, it prompts for the Domain
B user id and password. My understanding is that since both domains are trusted, Domain A users should also be able to access the web application. Please suggest any possible
reasons for this behavior.

The App Pool Identity seems to be one using Classic Mode, and it has "No Managed Code" selected.
The application hosted is developed using Classic ASP.
This has nothing to do with the identity
REF: Application
pool identity
The site is not added in the IE trusted zones - we cannot do this on all client computers. I am looking
for whether there exists some Active Directory/Network setting that displays this prompt.
You can do it with a GPO, but meantime you can do it manually on a client just for troubleshooting purpose
REF:
How to configure Internet Explorer security zone sites using group polices
Not sure whether the IIS host trusted for delegation or not. Could you please let me know what
it does?
Delegates IIS to request a kerberos ticket on behalf of the user
Some info here: http://www.adopenstatic.com/cs/blogs/ken/archive/2008/06/28/17805.aspx
This post is provided AS IS with no warranties or guarantees, and confers no rights.
~~~
Questo post non fornisce garanzie e non conferisce diritti

Getting Error The trust relationship between the primary domain and the trusted domain failed in SharePoint 2010

Hi,
SharePoint 2010 Backup has been taken from production and restored through Semantic Tool in one of the server.The wepapplication of which the backup was taken is working fine.
But the problem is that the SharePoint is not working correctly.We cannot create any new webapplication ,cannot navigate to the ServiceApplications.aspx page it shows error.Even the Search and UserProfile Services of the existing Web Application is not working.Checking
the SharePoint Logs I found out the below exception
11/30/2011 12:14:53.78 WebAnalyticsService.exe (0x06D4)        0x2D24 SharePoint Foundation         Database
8u1d High    Flushing connection pool 'Data Source=urasvr139;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False;Connect Timeout=15'
11/30/2011 12:14:53.78 WebAnalyticsService.exe (0x06D4)        0x2D24 SharePoint Foundation         Topology
2myf Medium Enabling the configuration filesystem and memory caches.
11/30/2011 12:14:53.79 WebAnalyticsService.exe (0x06D4)        0x12AC SharePoint Foundation         Database
8u1d High    Flushing connection pool 'Data Source=urasvr139;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False;Connect Timeout=15'
11/30/2011 12:14:53.79 WebAnalyticsService.exe (0x06D4)        0x12AC SharePoint Foundation         Topology
2myf Medium Enabling the configuration filesystem and memory caches.
11/30/2011 12:14:55.54 mssearch.exe (0x0864)                   0x2B24 SharePoint Server Search      Propagation Manager
fo2s Medium [3b3-c-0 An] aborting all propagation tasks and propagation-owned transactions after waiting 300 seconds (0 indexes) [indexpropagator.cxx:1607] d:\office\source\search\native\ytrip\tripoli\propagation\indexpropagator.cxx
11/30/2011 12:14:55.99 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
75dz High    The SPPersistedObject with
Name User Profile Service Application, Id 9577a6aa-33ec-498e-b198-56651b53bf27, Parent 13e1ef7d-40c2-4bcb-906c-a080866ca9bd failed to initialize with the following error: System.SystemException: The trust relationship between the primary domain and the trusted
domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection sourceSids, Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection
sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()
at Microsoft.SharePoint.Administration.SPAcl`1.Add(String princip...
11/30/2011 12:14:55.99* OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
75dz High    ...alName, String displayName, Byte[] securityIdentifier, T grantRightsMask, T denyRightsMask)     at Microsoft.SharePoint.Administration.SPAcl`1..ctor(String persistedAcl)
at Microsoft.SharePoint.Administration.SPServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPPersistedObject.Initialize(ISPPersistedStoreProvider
persistedStoreProvider, Guid id, Guid parentId, String name, SPObjectStatus status, Int64 version, XmlDocument state)
11/30/2011 12:14:56.00 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
8xqx High    Exception in RefreshCache. Exception message :The trust relationship between the primary domain and the trusted domain failed.
11/30/2011 12:14:56.00 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Timer
2n2p Monitorable The following error occured while trying to initialize the timer: System.SystemException: The trust relationship between the primary domain and the trusted domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection
sourceSids, Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type
targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()     at Microsoft.SharePoint.Administration.SPAcl`1.Add(String principalName, String displayName, Byte[] securityIdentifier, T grantRightsMask,
T denyRightsMask)     at Microsoft.SharePoint.Administrati...
11/30/2011 12:14:56.00* OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Timer
2n2p Monitorable ...on.SPAcl`1..ctor(String persistedAcl)     at Microsoft.SharePoint.Administration.SPServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.OnDeserialization()
at Microsoft.SharePoint.Administration.SPPersistedObject.Initialize(ISPPersistedStoreProvider persistedStoreProvider, Guid id, Guid parentId, String name, SPObjectStatus status, Int64 version, XmlDocument state)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(Guid
id, Guid parentId, Guid type, String name, SPObjectStatus status, Byte[] versionBuffer, String xml)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(SqlDataReader dr)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.RefreshCache(Int64
currentVe...
Please guide me on the above issue ,this will be of great help
Thanks.

I have same error. Verified for trust , ports , cleaned up cache.. nothing has helped.
The problem is caused by User profile Synch Service:
UserProfileProperty_WCFLogging :: ProfilePropertyService.GetProfileProperties Exception: System.SystemException:
The trust relationship between the primary domain and the trusted domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection sourceSids,
Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type
targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()     at Microsoft.SharePoint.Administration.SPAcl`1.Add(String principalName, String displayName, SPIdentifierType identifierType, Byte[]
identifier, T grantRightsMask, T denyRigh...
08/23/2014 13:00:20.96*        w3wp.exe (0x2204)
        0x293C        SharePoint Portal Server              User Profiles
        eh0u        Unexpected        ...tsMask)     at Microsoft.SharePoint.Administration.SPAcl`1..ctor(String persistedAcl)
at Microsoft.Office.Server.Administration.UserProfileApplication.get_SerializedAdministratorAcl()     at Microsoft.Office.Server.Administration.UserProfileApplication.GetProperties()     at Microsoft.Office.Server.UserProfiles.ProfilePropertyService.GetProfileProperties()
Please let me know if you any solution found for this?
Regards,
Kunal

DNS/LDAP Issue for Trusted Domain

Hi
I'm trying to configure Configuration Manager 2012 R2 Forest Discovery to a trusted domain.
Objects from the trusted domain (users/computers) show up in the Collections, but when I check under Administration\Active Directory Forests I can see Discovery Status "Failed to connect using default account" and Publishing status "Cannot
Contact LDAP Server".
I've added the SCCM server to local admin at the trusted domain via GPO and have also created the system Management container.
When I check the log ADForestDisc.log I get this error message:
"Failed to connect to forest X. This can be because of disjoint DNS namespaces, network connectivity or server availibility issue. Error Information The specified forest does not exist or cannot be contacted."
I have setup Conditional Forwarders in DNS in both domains.
I have also read other forums about this issue and should have the answer:
"This error occurs for all of the domains that you mentioned and is typical when SRV records for DCs in those remote domains cannot be found. Forest discovery relies on DNS name resolution of SRV records to locate a suitable DC to communicate with."
"The site server performing the forest discovery must be able to resolve the SRV records for the DCs or root domain of the other forest."
We are using Windows AD integrated DNS in both domains.
I'm not so familiar with DNS configuration so I appreciate if someone could tell more specific how to fix this.
Thanks in advance

Hi
Thank you for your answer. This issue is solved. I've missed to open some ports in the router/firewall between the LANs.
The status under Active Directory Forests is Succeded now, but when I check under boundaries, I can only see the "Default-First-Site-Name" site for the first domain (same LAN as CM Server) and I can only see the IP address range for that LAN.
I don't Think this is a big issue, but shouldn't the site name and address range for the other LAN (where the trusted domain is) be automatically found to during forest Discovery when I've checked the options to create site and ip boundaries automatically?

SQLServer Reporting Services 2005 Prompts for Credentials for a trusted domain user

Currently the report is running in the domain AAA. Users in the domain AAA are using the report.
Another new domain BBB and an user XXX is now created and BBB\XXX has been given Browser access. Domain AAA and BBB are trusted domains.
After this when the user BBB\XXX logs in and access the report, before loading the report, credentials dialog is prompted, once credentials of BBB\XXX is entered, the report is loaded.
Why the report prompts for this additional credential dialog for the trusted domain user?

Hello,
Did you have get two textboxes in the report parameter panel (in the left side of the "View Report" button)? The issue is occurred when the credential of the datasource is configured with “Prompt for credentials”. Please check if you configured the credential
with "Stored Credential" of the datasource.
Please refer to the following thread to configure the credential.
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/1564cd7a-6b7a-40f1-9f98-5c766ebfc63e/datasource-userid-and-password-being-asked-eachtime-when-report-is-generated?forum=sqlreportingservices
Regards,
Alisa Tang
Alisa Tang
TechNet Community Support

Read Only for Non Trusted Users

Hi everyone:
Is it possible to forbid non trusted (or non certified) users for modifying the pdf (I'm interested in signing protection particularly) but allowing them to open the pdf in READ ONLY mode?
I'm wondering how to do it using Adobe Acrobat Professional 8 (info with Adobe Acrobat Pro X will be also appreciated) and opening the pdfs in their Reader corresponding versions (managing non trusted users as READ ONLY users).
Thanks for your time
Regards,
Javier

Thanks Bill:
I've been trying what you said, and is possible to "lock" the pdf so it's in read only mode via password (using Adobe Acrobat X). Is it possible to do the same with certificates? As far as I have seen, if you use certificates policies, you use the certificate to encrypt the document but then, non certified users are not allowed to access the pdf. I'm really interested in using certification restrictions but being able to access the pdf: I want to simulate the READ ONLY MODE for everybody and the WRITE mode for certified users.
Using this kind of restrictions, the only problem that I see (for end users) is that they should disable secure settings before editing / signing (this two options appear disabled with this method). Is it possible to get them available and open the "enter password" dialog when clicking them, not managing the security properties?
Thanks for your time
Regards
Javier

Hi, i cannot publish my iWeb site with a non mac domaine name...can anyone help please?

hi, i cannot publish my iWeb site with a non mac domaine name...can anyone help please?

Hi, I have a site developed by myself usinf iWeb and as iWeb are no longer hosting teh sites in 2012 i have found another domaine. It is with Go Daddy and the domaine / name is live. I have tried to publish site using fttp but keeps coming up wih a common error message saying the info i have input is incorrect. I have tread this may be an issue if host is a windows based host???
appreciete your help

Rd web showing all remoteapps when logging in with an account of a trusted domain

we have a dmz with a separate domain. there is a one way trust to our local domain
In the dmz domain there is a rdweb and rd gateway. When logging in with an account from the dmz domain in the rdweb it's all fine but when logging in with an account from the trusted domain all remoteapp's are shown
all servers are 2012r2

Hi sir,
Please make sure your account has already added into your Pay-As-You-Go subscription as co-administrator role . If the account was not in your subscription please add it and try to login on from your VS again.
If you always occurred this issue, you can try to download the publish file and import it into you VS, please follow this steps:
http://azure.microsoft.com/en-us/documentation/articles/mobile-services-windows-how-to-import-publishsettings/
Regards,
Will
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Using iWeb to publish to a non.mac domain

Can I use iweb to develop a web site and publish to a domain that is not .mac?
Or can I host a non.mac domain on .mac?

Can I use iweb to develop a web site and publish to a
domain that is not .mac?
Yes, you can. But not directly from iWeb. You will develop your pages in iWeb but the choose the "Publish to Folder" option. This will put all the files necessary for your website in a folder on your hard drive. You will then need to use an FTP program to upload the site files to your 3rd party web host.
Or can I host a non.mac domain on .mac?
Yes, you can also do this. You can do your pages in iWeb and then "Publish to .Mac". Then you can use "Domain Forwarding" available from your registrar or some other redirecting html to forward people who type in your domain name to you .Mac iWeb URL.
Either method will work fine. You will lose out on .Mac specific features (like slideshows, counters, passwords, comments, search) if you host your pages on a 3rd party web host. Also you lose the ability to do incremental uploads (uploading only changed pages) directly from iWeb if you're not using .Mac.
Good luck to you. If this has been useful information to you, please do me a favor and click the "solved" or "helpful" buttons in the title bar of this reply. Thanks.

IWeb Blog to non-.mac Domain

Hello good folks,
I have my business Website at its own (non apple) domain. I would like to use iWeb to create a blog, and then attach that blog to my business Website. (Therefore, it would be an alternative to wordpress, blogspot, etc.)
Is this
-- possible?
-- advisable?
-- easy?
-- pain?
A secondary question: If those answers are a reasonable "yes," then is it possible to update my blog from both my Mac Pro and my PowerBook, and still keep everything reasonably organized?
Many thanks, as always.

Mireille,
The helpful tips and product review 'blog' is an 'add-on' to our online store which has a shopping cart and it's SEO set ups that work well. It was made from a template in GoLive. The store is the primary concern and the blog is intended to be a convenient format to provide useful dynamic content to drive search engines and customers to our store.
If I could figure out to use something besides a frame I would as I understand the frames are not search engine friendly either. After submitting the sitemap for the blog, it was interesting to see that only the apparent entries get listed in Google. So, it appears that it is dependent on how many 'excerpts you show' in iWeb and not the archives and it's content.
If there is a sitemap generating app that will point Google to the content in the archives, I'd be very interested to know about it and how effective it is. I've found site search options I can add to the blog content if I load it directly to the site and set up pages versus frames....if the content can be searchable and generate the proper site map.
Here's an interesting page from Rage: http://www.ragesw.com/blog/2008/04/12/seo-for-iweb-how-to-get-your-iweb-websites -into-google-other-major-search-engines/ (which I notice you responded to....:-) )
What does Rage do that this free option I used do better? http://www.xml-sitemaps.com/
I started this thread to hopefully get some ideas:
Blog and personal domain/store, SEO & other issues
http://discussions.apple.com/thread.jspa?threadID=1522542&tstart=30

OSD Across a Non-Trusted Domain

Similar Messages

Maybe you are looking for