Provisioning to AD - in another forest

Hi,
I have tried to setup FIM2010 to provision users to AD (different forest).
While configuring the AD MA, have provided IP address in the place of server, and UPN for login and left the domin blank.
Have configured "Preferred DC" to use in the MA.
I am able to connect to AD, do a full synch. While running the export profile, I am receiving "cd-connectivity-errror" (stopped connectivity) .
However the users are getting created in disabled state (514 status). There is no much load and I have tried to export one user only.
Am I doing something wrong.
Regards
Sai

Sai,
If you try to enable the user that gets created, do you get an error stating the password is invalid? If so, the password is not getting set properly. This could be because the domain value is not valid in the AD MA, or the firewall is
blocking the kerberos password set port (464 if I recall rightly), or the service account you've defined in that forest does not have the required rights to set passwords on user accounts.
In terms of the domain name, you should be able to set it to the NETBIOS value (ACME) or the FQDN value (acme.com). The forest name can either be the FQDN of the forest, or for some clients with restrictive firewalls, I've had to specifiy a preferred
DC FQDN there. Other ports you will want to verify are open are 53 (DNS) and 88 (Kerberos).
Cheers,
Marc
Marc Mac Donell, VP Identity and Access Solutions, Avaleris Inc.
http://www.avaleris.com

Similar Messages

Exeuting a file in another forest

Hello Community
    Using Windows 2008 Server on a network there is a file that I
am attemping to execute in another forest.
    Lets call them Forest1/Domain1(trusted) and Forest2/Domain2(trusting)
in a One-Way Trust Relationship.
    Server1 is in Forest1/Domain1 and Server2 is in Forest2/Domain2.
    The filename is MyFile.exe and it resides on Server1 in Forest1/Domain1.
    Server1 us a portal in Forest1.
    Executing the file has to be done using a url for example:
http://Server1/MyFile.exe
    What is the correct syntax for the url to execute MyFile.exe that exists in
Forest1/Domain1 on Server1 using http?
    Thank you
    Shabeaut

Hi,
Glad to hear that the issue is resolved and thanks for sharing the information!
Steven Lee
TechNet Community Support

Move domain to another forest (forest trust)

Hello
I have a forest with many domains , and other forest with a domain. They include a trust set up and working . I would like to have only one forest, but it would need to move that single domain in additional forest, and would like to know if it is possible then
moving a domain from one forest to another forest in forest trust ?
Thanks also suggestions stop solve my problem

You're asking to move the domain itself? No, you can't move the domain. You can create a new domain in the forest you want to consolidate to, and then migrate users and groups to that forest. You'll have to migrate workstations and users and repoint
applications as well, if needed. And then, you're not really moving them, you are creating new ones and copying properties of those objects. You mentioned a forest trust but all the forest trust allows you to do is to assign/use permissions from one forest
in another. People speak of moving objects but like I said, for users and groups you're simply creating new ones with the same names, and copying properties over. Computers/servers are joined to the new domain, but it's a new computer account, not one that
gets moved over.
You'll need a migration tool to do this smoothly. As Malek mentioned ADMT, yes this is one tool that can do this. It's not necessarily the best or easiest tool, but it's free from Microsoft. There are also other third party tools such as Dell/Quest
Migration Manager for AD and BinaryTree also has similar tool (there are others out there too). Those two latter tools have the ability to add permissions (ACL entries) to new domain objects, based on the old ACLs from the source domain. This can be a huge
help for servers and workstations (allows the users to continue to use their same profile after their computer is migrated, and they are using their new user account. Otherwise Windows would just create a new profile when the user logged in with his/her new
domain account.
Depending on the size of the domain you want to move (how many objects), this could be a pretty big project. There's a lot going on in a migration, and based on your question, I'd recommend finding help with it if you can. There are a number of companies
and consultants who specialize in AD migrations, even some consultation for planning could help tremendously.

[SCCM 2012 R2] - IBCM - Authenticate computers on TMG from another forest

Hi All,
There is no article on TechNet that describe client certificate requirements for computers in another forest.
Scenario:
We have Domain A [aaa.bbb.ccc] and Domain B [111.222.333] and those domains are in different forest. There is "Forest" trust between forests.
TMG and IBCM site server are in Domain A and computers authenticate successfully from Internet to TMG using SSL client authentication. Problem are computers from Domain B that cannot authenticate to TMG.
We used old documentation
https://technet.microsoft.com/en-us/library/cc707697.aspx#AppendixA for SCCM 2007 and ISA without success. I created certificate for computers in Domain B with custom
SAN:upn=<hostname>$@<domain.tld> and TMG still cannot authenticate computers from Domain B.
Please help.
Thank you in advance.
Regards,

There's no difference -- ConfigMgr does *not* care about forests, domain, or trusts for client authentication and neither does certificate based authentication.
The certs in use, both the client auth and server auth certs, must of course be trusted by the site systems and the clients and in this case the TMG server -- that's simply how certs work though and has nothing to do with ConfigMgr. Additionally, the CRLs
for the certs in use must be accessible to the clients and servers via an accessible CRL DP but that is also simply how certs work.
For what you've described above, does TMG trust the certs issued to the clients? In other words, does it trust the CA that issued those certs and can it access a CRL for that CA?
Jason | http://blog.configmgrftw.com | @jasonsandys

Is it possible to deploy VM with RDS RDVH in one forest and VMs in another forest?

Hello,
We have a situation with a Remote Desktop Services (RDS) with virtual desktops (RDVH) where we are limited in our possibilities. We have a multi forest domain structure with trusts between the forests, some trusts are 2 way trusts,
some trusts are 1 way trusts and some forests have no trust at all.
We are trying to implement a RDS solution with virtual desktops, the servers are in domain 1 and the client VDI VM’s are in domain 2. Our question is in which trust configuration (domain trust/ forest trust) is this supported and
is there any documentation?
Our consideration is that we are not flexible and we need hardware for every forest and it’s getting very expensive.

Hi Sir,
>>We have a multi forest domain structure with trusts between the forests, some trusts are 2 way trusts, some trusts are 1 way trusts and some forests have no trust at all.
If you want to deploy VDI VMs into another domain , you may need to build 2way full trust between RDS domain and the destination domain .
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

What is necessary for FIM to connect to an AD in another forest?

Hello
I have FIM 2010 R2 installed on fim1.fim1.local working happily provisioning users into fim1.local domain.
Now due to merger we have a second forest additional.local
What is necessary for the existing FIM install to manage users on the additional.local forest as I cannot connect without error?
I can access the additional.local DC from the FIM Server and read the directory. Port 389 is open. I have a domain account on additional.local.
When I try to make an AD MA. I get the error message:
"Failed to search on DN cn=Aggregate,cn=Schema,cn=Configuration,dc=additional,dc=local"
and error code is 0x34.
I tried these values:
Forest: addDC.additional.local
User Name: Administrator
Password: ***
Domain: additional
Where am I going wrong?

Yes I can connect to the external forrest when the DCs have ports 389 88 53 and 464 listening.
However, just one oddity in this FIM. When I push the "Containers" button to select the containers. I must first configure and Add the preferred domain controller (as given on previous dialog form) before I get the list of OUs.
After configuring I can switch it off and all is Ok.
just a comment,just wondering why.
*HH

Objects showing from another forest\domain ...

Hello Community
    On Windows 2008 Server when I go to Windows Explorer, under "Network"
in the right pane there are 4 columns:
Name               Category              WorkGroup
Network Location
    It is here that I see my server's names under "Name", Computers under
"Category", NetBios name under "Workgroup" and FQDN\Forest name under
"Network Location" which is fine.
    However in addition to my own objects that I see in the right pane of
Windows Explorer I also see objects from another domain the exists in
a totally separate forest, how can I see or how could those objects reside
or be displayed in my forest\domain (unless someone else put them there)?
    Thank you
    Shabeaut

Hello Susie Long
    There is only one network.
    There are 2 separate forests.
    Each forests has has separate domains.
    Under "Network" not all of the objects from the other domain
in the other forest are being displayed, only some of the objects
from the other domain in the other forest are being displayed under "Network"
in this forest.
    That is what is puzzling, are you saying that all of the objects from
the other domain in the other forest should be visible in this forest and if
so why aren't all of the objects visible (I was under the impression that
only the objects in this domain in this forest should be visible under "Network"
in this forest)?
    Thank you
    Shabeaut

Integration of SCCM in another forest

Hi,
I have a standalone primary SCCM 2012 in Forest A with 10k clients assigned to it. Now my company is planning to aquire another company which is having 5K clients reporting to a different standalone primary SCCM 2012 in Forest B. My
question is, I wanted these two sccm setup to be managed from one single heirarchy preferable from Forest A. How can i merge them? Do i need to re-install the clients here or can I setup a CAS in forest A, make the primaries in both forest report to them.
If this is the case, do i need to do any changes to the clients in Forest B?
Regards
AKP

Hi,
No you cannot merge them, you cannot migrate two primary sites to a new CAS. what you can do in ConfigMgr 2012 SP1 in add a CAS to and existing primary but not migrate an existing primary to that CAS.
So the scenario you face is to use the bulitin Migration feature in Configuration Manager 2012 Sp1 (it requires sp1) and migrate packages/programs and all the objects you need to either a new Primary site or one of the existing ones and use that in the future.
After that you reassign the clients to the new site.
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

Migrating mailboxes to another forest Exchange organisation

Hello,
We are looking to achieve 2 migration tasks: one is to upgrade one Exchange organisation from 2010 to 2013 and the second is to migrate mailboxes from the second organisation to the new 2013 server.
To explain the scenario in a bit more detail:
Forest A – 1 AD domain with a single Exchange 2010 server
Forest B – 1 AD domain with a single Exchange 2010 sever
Stage 1 – Migrate Forest A to Exchange 2013
Stage 2 – Migrate mailboxes from forest B to forest A but still keep forest B as its own AD domain. Or to put it another way; we want the users in forest B to have their mailboxes migrated to forest A (linked mailboxes?) but still keep use forest B to login
etc, essentially making forest A a resource forest for users in forest B
I hope that makes sense! One of my main concerns is I am assuming it is possible to perform a cross forest migration from forest B which will be at 2010 to forest A which will be 2013. Would it be better to perform the cross forest migrations before hand?
If someone is able to let me know if what I am proposing is possible I would be extremely grateful.

Hi
There is no problem with any of those ideas. You can migrate cross-forest between to either 2010 or 2013 irrespective of the source Exchange version, using the native tools.
http://technet.microsoft.com/en-us/library/ee633491(v=exchg.150).aspx
If you want to have them as linked mailboxes you just specify the -linkedmailuser switch when you run the preparemoverequest.ps1 script, you then perform the remote move as described in the link above.
Steve

AD authentication for domain in another forest- XI R2

Situation:
- Windows 2003
- BOXI R2 (tomcat)
- 2 domains (in different forest)
- trust between the two domains
We have succesfully installed the AD-authentication plugin for domain1.
To work around for domain2, we've added users from domain2 inside a group of domain1, but these users are not shown inside the CMC when we import the AD-group.
Can we use the LDAP plugin for the domain2? What should be the procedure?
If found a similar question on this forum from one month ago, where they were talking about BO3 SP1, which will support multiple forest. But not really a solution the could help me out now.
Please advise
Thanks in advance!
Quinten

In XIR2 we cannot map in groups that contain users from 2 different forests. To work around this we could use LDAP to AD, but there are a few limitations.
If you want to upgrade the version that should contain this will hopefully be out by the end of this month XI 3.1 or XI 3.0 integrated SP1.
There should be some notes on using LDAP to AD in the SMP as well as it's documented in the [XI 3.0 Admin Guide|http://help.sap.com/businessobject/product_guides/boexir3/en/xi3_bip_admin_en.pdf]
Regards,
Tim

How do i connect manually to Exchange 2013 from Outlook 2007/2010 in another forest?

Hello All,
I have a source organization: Windows 2003 domain + Exchange 2010 SP3 + smtp domain acme.com
Target organization: Winows 2012 R2 domain + Exchange 2013 CU3 + smtp domain acme.com
We are migrating to target organization.
I want to connect Outlook 2007/2010 to their target mailbox (Exchange 2013) from a machine which is joined to Source DOmain.
I couldn't use autodiscover, because as the machine is joined to source domain, autodiscover it's mapping to Exchange 2010.
It only works when I machine is joined to target domain.
Any idea how to connect manually to eXCHANGE 2013 mailbox from a machine which is joined to source domain?
Regards
José Osorio

Hi,
Firstly, I’d like to explain, Autodiscover service can be used cross forest:
1. the two forests must be trusted.
2. configure a mail contact in the original forest.
For more information, please refer to the partition named how to configure the Autodiscover service for cross-forest moves in the following article:
http://technet.microsoft.com/en-us/library/jj591328(v=exchg.141).aspx#BKMK_ConfigureForCrossForestMoves
Thanks,
Angela Shi
TechNet Community Support

How to remove admin permissions AD DS when admin from one forests access resources in another forest?

Hello Community
    A forestA and
a forestB exists on the network.
    In forestA, active directory has an administrator.
    In forestB, activre directory also has an administrator.
    There is a trust reletionship between the 2 forests.
    When the administrator for forestA accesses resources
in forestB, how can I make sure that the administrator in
forestA does not have administrative permissions in foresB?
    Thank you
    Shabeaut

They do not have access by default unless if you delegate that to them. For high secure environments, you might consider implementing a Selective Authentication: http://technet.microsoft.com/en-us/library/cc755844(v=ws.10).aspx
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password

Mailboxes in another forest

I'd like to ask what are my options on a scenario described here:
Two AD forests without any trusts between (let's call em old and new)
Old has users and Exchange 2000
New has the same users (with new samaccountnames) and Exchange 2013
There's no need to migrate boxes from 2000 to 2013, .pst files can do this
There's a firewall between these two forests, this can although be handled
Name resolving is in Place and both old can resolve DNS names for the systems in the new and vice versa
I'd like the users who are still using the Old AD to start using the Exchange 2013 mailbox (and addressbook with it's distribution groups) they have in the New AD (and kill the old Exchange 2000 once and for all). What are my options? Is there trust needed
between the old and new AD forest? Can it be configured so that user's wouldn't be prompted for username/password when they use their new mailbox (which is in the new AD) from old AD?

Hi Narcoticoo,
Base on my knowledge , you can use "linked mailboxes" mode between two AD forest.
You can treat old AD as an account forest, and treat new AD as an exchange forest.
However, you must store all the .pst files in the old AD, and then uninstall exchange 2000, just leave all the AD account.
I recommned you refer to the following article to understand "Linked Mailboxes":
Manage linked mailboxes
Please note:
A trust between the Exchange forest and at least one account forest must be set up before you can create linked mailboxes. At a minimum, you must set up a one-way, outgoing trust so that the Exchange forest trusts the account forest.
Best regards,
Niko Cheng
TechNet Community Support

Adding external data from another forest?

Hello Community
    The following 2 scenarios are how data is entered and stored in a non-Sharepoint environment:
    Scenario a) C# ASP.Net or C# Windows applications are used to enter data that gets stored
into SQL Server databases on a network.
    Scenario b) Users create Word applications, Excel Spreadsheets, PDF's, etc and the data is
stored in folders on servers on a network.
    In the future a Sharepoint 2013 Server farm is created in a domain in a separate forest.
    The question(s) is:
        #1) How do you add those servers that contain the data in the pre-existing
             SQL Server databased to the Sharepoint 2013 farm?
        #2) How do you add those servers that contain the data in the pre-existing
             Word documents, Excel spreadsheets, PDF's, etc into the Sharepoint 2013 farm?
        #3) If it exists, what 3rd party software stated in either #1 and/or #2 above can
             add those servers or import that data on those servers into the Sharepoint 2013 farm?
    Note: If BCS can be used does each client need to have Microsoft Office 2013 installed
          on each client computer?
    Thank you
    Shabeaut

SharePoint won't be able to manage documents in those custom/3rd party databases. If this is a 3rd party database, there may be a solution to migrate the information into SharePoint. If it is custom/in-house, then you'll need to build migration utilities
yourself.
Ideally, those documents should reside within Document Libraries in SharePoint to have full management over those documents.
As for BCS, it is meant more for display List-style data, not documents. But clients do not have to have any components installed to leverage BCS, as BCS is a service on SharePoint.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Move account to another forest

Dear.
We have two forests with a forest trust between them. Today, our users are in Forest A, their Exchange 2013 mailbox too. We want to move the user accounts to Forest B while their mailbox remains in forest A.The accounts are synced between both forests.
Are there command line, PowerShell command we can use to automate this? If so, how.
Does someone has a link to a good article or document describing this procedure?
Thanks in advance.
Regards.

Hi,
You can use the ADMT to perform object migrations and security translation as necessary so that users can maintain access to network resources during the migration process.
What's more, here is a thread for your reference.
Cross Org migration
http://social.technet.microsoft.com/Forums/exchange/en-US/1ecd1261-fa66-4b4a-9c52-a51917d84356/cross-org-migration?forum=exchange2010
Hope it helps.
Best regards,
Amy Wang
TechNet Community Support

Provisioning to AD - in another forest

Similar Messages

Maybe you are looking for