Set-up of a Forest Trust - Unique situation

I am in need of advice on how to setup a forest trust between to separate, but similar forests.
My AD server is Server 2012R2, their AD server is Server 2008R2.
We are a small community college in the process of separating from our parent university, current the parent university has AD services for both domains ( theirname.edu and ourname.edu) I have built a completely new & separate AD server on a different
network using the same ourname.edu as the parent university is currently using.
Is it possible to setup a forest trust between the NEW ourname.edu and the old ourname.edu?
We are trying to get the NEW AD server up and running so as that it can be fully functional by users, also this trust is so we can migrate our student & employees user data from the OLD AD to our NEW AD using ADMT tool or something similar.

You can't create a trust between two domains/forest with the same name. How would the client know where to go to when referencing the name?
One thing to consider is a radical pruning situation. You could introduce a new server in the theirname.edu and promote it as a new DC. Then physically remove it from the domain and
NEVER all it to talk to the theirname.edu ever again. In the theirname.edu do a metadata cleanup of this recently promoted DC to remove all references of the DC.
http://blogs.dirteam.com/blogs/paulbergson/archive/2009/06/09/active-directory-cleanup-the-most-common-question-i-see.aspx
Now sieze all FSMO roles on the DC you just removed and consider this the first DC in your forest. Go back within this forest and do a metadata cleanup of all the old DC's.
You now have a duplicate forest that should be cleaned up removing all users and computers that didn't transfer from the original domain. The old domain should also cleanup all unused accounts and computers as well.
Just be aware that pruning isn't supported by Microsoft, but this is a known practice in mergers and divestures:
http://technet.microsoft.com/en-us/library/mergers_acquisitions_active_directory_prune_and_graft_restructuring_support_limitations(v=WS.10).aspx
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.

Similar Messages

Server 2012 R2 no longer able to query objects in a trusted domain over a Forest Trust using Selective Authentication

I have a scenario in which our enterprise activation servers exist in a domain that is in a separate forest than our offices. Currently all our domain controllers are 2008 R2 with domain and forest functional levels at 2008 R2. We have set
up two-way forest trusts with our office domains using selective authentication. We then give the domain controllers from our licensing domain the "Allowed to Authenticate" right to the domain controllers in the office domain. On the
server 2008 R2 domain controllers in the office domain, we can browse to the appropriate objects in the licensing domain after being presented with an authentication window that allows us to enter credentials for the licensing domain. However, after
installing a 2012 R2 domain controller in an office domain, we can not use the 2012 domain controller to browse to the objects in the licensing domain. It never asks for credentials for the licensing domain when we specify the objects we want to add
from the licensing domain. I simply states that the object can not be found. When I look at the domain controller in the licensing domain, I see that the domain controller in the office domain is attempting to pass the credentials of the user that
is logged on and this is failing since this user has no rights in the licensing domain. I can still use a 2008 R2 domain controller in the office domain to add the rights and it works like it always has. Can somebody tell me why this is happening
and how to correct it?

Hi,
Based on my research, this is a known issue in Windows Server 2012 R2.
According to the article below: “The Selective Authentication feature of selective trusts is
not functional. Access to resources enabled by “Allowed to Authenticate” will fail. There is no workaround at this time”.
Release Notes: Important Issues in Windows Server 2012 R2
http://technet.microsoft.com/en-us/library/dn387077.aspx
Best Regards,
Amy Wang

[SCOM Forest] -- Certificate -- [Gateway Servers Forest] -- Trust Relationship -- [Multiple Forests]

Hello, and sorry for this strange title, i couldn't find a simple way to write my question.
- I want to use agent monitoring from my SCOM 2012 SP1 management servers
to servers in multiple forests.
- I don't want to set two-way trust between my scom forest and the monitored forests.
- I would prefer not to install 2 gateway servers in each forest.
So would it be possible to create a intermediate forest for my gateway servers, use certificate authentication between management and gateway servers, and use two way trust between this intermediate forest and forests to monitor.
[SCOM Forest]<-- Certificate --> [Gateway Servers Forest] <-- Trust Relationship --> [Multiple Forests]
Do you think this would work ?

Hello,
worked
your
approach?
I'm
in
a
similar
situation,
can you
share
the
results?

Two-way forest trust between two (single domain) forests with multiple identical user ID's

Domain and forest levels - Windows 2003 (they both have one 2008 R2 DC)
We need to create a two-way forest trust between two separate single-domain forests. The problem is that these two forests already access each others resources through a S2S. Users have the same login names and passwords on both forests/domains. Now, we
are combining their infrastructures and need to set up a trust. From what I'm reading, you can't create forest trusts if you have the same SIDs, user ID's, or computer name in each of the forests.
I'm looking into AD migration tool to copy the userSIDs (SID history?) between forest/domain, deleting the user ID's in the domain we migrated from, and then setting up the trust, but I'm leery about doing it this way as there is no easy 'recovery' should
something go wrong.
Any suggestions for the easiest way to setup this forest trust?

Hi,
To eliminate your worries, two user accounts have the same user name doesn’t mean that they have the same SID. Moreover, the user’s SID remains the same even after it has been renamed.
The SID for domain account/group consists of a
Domain Identifier and a Relative Identifier. Domain Identifier is unique in every domain within a forest, and a Relative Identifier is unique within domain. It is unlikely that two user accounts with or without the same account
name from two forests have the same SID.
The Technet article you mentioned is talking about duplicate SIDs instead of “duplicate computer name or user account”, I will submit a change request to Microsoft about this.
If there are duplicate SIDs when you create forest trust, you need to delete one of them as the article guides.
Here are some related articles below for your references:
How Security Identifiers Work
http://technet.microsoft.com/en-us/library/cc778824(v=WS.10).aspx
Security Identifier Structure
http://technet.microsoft.com/en-us/library/cc962011.aspx
Security Identifier
http://en.wikipedia.org/wiki/Security_Identifier
I hope this helps.
Amy Wang

Forest trust unable to find Active Directory Domain Controller

I have two domains with a two-way forest trust. We'll call them ForestA and ForestB. They're on seperate subnets. ForestA's DCs are in one physical location. ForestB's DCs are in two locations, one of which is shared with A.
I'm unable to route traffic directly from the remote DC in ForestB to the subnet ForestA is on, so I created a new DC in ForestA that sits on the subnet ForestB uses (basically, I can't route between subnets via the wireless bridge between locations, but
can within the same location).
I found this: http://www.neomagick.net/zen/2008/11/30/using-dns-to-force-a-domain-trust-through-a-specific-domain-controller-dc/
I followed the instructions to set the new DC in forest A to be the only one the remote DC in forest B was aware of.
Nslookup ForestA.com resolves correctly to this DC, but I'm unable to validate the trust relationship, getting the error:
"Windows cannot find an Active Directory Domain Controller for the ForestA.com domain. Verify that an AD DC is available and then try again."
I'd appreciate any help.

In the event viewer, have you found any event id's that corrospond with this error? Have you ensured all ports required are open? Windows firewall is correctly setup? NIC is properly configured?
Statement below taken from: http://technet.microsoft.com/en-us/library/cc961803.aspx
If you receive the following error, ERROR_NO_LOGON_SERVERS while using the Nltest tool to query the secure channel, this is usually indicative of the inability to find a domain controller for that domain. Run nltest /dsgetdc: < DomainName > : to verify
whether you can locate a domain controller. If you are unable to find a domain controller examine DNS registrations and network connectivity.
ADDS Ports:
http://msdn.microsoft.com/en-us/library/dd772723(v=ws.10).aspx

Forest Trust Issues (Group Membership Issues)

OK - this is going to be long. I hope I am detailed enough.
Four domains, each in their own forests:
domain.w.com
domain.x.com
domain.y.com
domain.z.com
For the sake of everyone, I'll refer to each domain as "w" or "x", which would be domain.w.com and domain.x.com, respectively.
Domains x, y, and z all have users that require access to resources on domain
w. Remember - each domain is in its own forest.
Three trusts were created on domain w. Since the users on domain w do not need any resources on the other domains, three "ONE-WAY:OUTGOING" trusts were created (one for each) via Active Directory Domains and
Trusts on domain w. The option to create the trust (have it show up in Active Directory Domains and Trusts) in the other domains (in this case
x, y, and z) was selected.
After the trusts were created from domain w, the trusts were verified. Administrators on domain
w could "verify" the trusts (using admin accounts created for them on the three trusted domains).
Since everything looked good (domain w shows up as an incoming trust for the other three domains), permissions for specific users on domains
x, y, and z were granted for a share in domain
w.
Only... that didn't happen. When attempting to change permissions on the share, administrators were able to change the working domain directory to either
x, y, or z... but searching returned zero results. Zilch.
*It should be noted that this scenario has been in place for quite some time now, and that all groups/users previously defined on the share (that belong to the three domains trusted by domain
w) now all show up as SIDs.
When attempting to verify (validate) the incoming trust on any of the three domains, the error "Windows cannot find an Active Directory Domain Controller for the domain.w.com domain. Verify that an AD DC is available and then try again."
is returned.
Pinging domain.w.com returns the correct address. Direct pings to both domain controllers on domain w
is also working. Domain w can also do the same pings that I just listed to all three other domains with correct results.
There is no firewall in between these forests.
I am leaning towards a DNS or AD issue on the domain w side. This all occurred at once on the same day last week, and no changes were made on
x, y, or z. Of course... domain
w is another entity and they are saying they have no clue why its not working.
Questions:
Should I be able to verify the trust from x, y, or
z to domain w?
Why cant domain w see the users/groups in the other domains?
Why does domain w validate the trust if the other three domains cant?
Could this be caused by some setting in GPO having to do with LDAP security, signing requirements, or authentication settings?
Any help is much appreciated.
Chris

Yes, this is related to DNS, from what you describe.
The simplest way to configure this is to go to EACH dns server on both sides of the trust and configure it for a conditional forwarder of the others dns zone.
http://www.techrepublic.com/blog/windows-and-office/configuring-dns-forwarders-to-support-windows-server-2003-forest-trusts/501/
Unless you have a root dns server for all four zones already.
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.

Forest Trust RPC timeout across MPLS

Hi, I am having trouble setting up a Forest trust between two networks. The issue "seems" to be RPC timeout (i see RPC age-out on firewall) but i'm now wondering if it's actually the LDAP or KErberos thats failing first.
I have read that RPC needs to have the same path outgoing as incoming otherwise you can get SYN-ACK problems (especially through a firewall). So i need to try and work out why it doesnt work. It is laid out something like this.
Network 1 (domain BOB) (server 2008 R2 at domain functional level 2003)
Site1,Site2 and Site3 all connect to each other via Site-To-Site link provided by 3rd party. They all egress at Site1's ISA Firewall in a normal 3 leg perimeter config. All works fine
Network 2 (domain RITA) (server 2008 R2 at domain functional level 2003)
SiteA,B,C and D all connecto to each other over 3rd party MPLS (essentially Gig ethernet)
Site1 and SiteA are on the same premises in the same room. There is a spare NIC on the ISA server. So i configured the ISA with a NIC in the same subnet as SiteA (RITA domain) - ie i plugged RITA into BOB. I configured the ISA for routing. Allow ANY ANY
internal to RITA and ANY ANY RITA to internal
I set up conditional forwarders on both domains pointing at each other and can ping everything from the other sites. DNS is working fine. I can RDP across sites to each other's DCs. From a "network" point of view it all looks good (though in the
back of my mind i cant rule out the site to site or the MPLS links)
When i try and create the trust it fails very quickly with "Cannot Continue. The trust relationship cannot be created because the following error occurred: The operation failed. The error is: The remote procedure call failed"
I can do a portqry and see all RPC comms looks good
In ISA and another firewall i tried i can see the RPC ageing out. Have tried wireshark but hard to see whats going on
I used another server in the BOB domain and dcpromo'd it to a new domain in that subnet and tried setting up a trust. worked first time
Similarly i did the same at the RITA side and that worked too.
THere are no errors in DNS or the event logs on either side to suggest anything is failing. i tried verbose DNS logs but couldnt really follow them.
Help!! Thanks

Hi,
To verify if this is a network issue, please try to perform a network capture on the servers in both side.
We can use "IPv4.Address==xxx.xxx.xxx.xxx" to filter the traffic between the servers. Then compare the capture data from the servers. If all the packets have been forwarded, it should not be caused by network.
To download Network Monitor, please click the link below:
http://www.microsoft.com/en-hk/download/details.aspx?id=4865
About the question related to Directory Services, to get better help, please post your questions on the DS forum.
Here is the address:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverDS
Best Regards.
Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Alternative UPN & Forest Trust.

Hi all!
I have 3 domain:
main.local
child.main.local (child of main.local)
test.local (new forest)
In "main.local", under Active Directory Site & Services, i defined 2 UPN:
"mycorp.com" & "child.mycorp.com"
I used "mycorp.com" as alternative upn for users in "main.local"
Then I used "child.mycorp.com" as alternarive upn for users in "child.main.local"
Now I'd like to trust "main.local" with "test.local" and use users in "*.main.local" with their alternative upn.
Example:
[email protected] should login in test.local with it's upn.
[email protected] shoud login in test.local with it's upn.
* 02/26/2014 correction.
I made a Forest Transitive Trust with one direction and all routed UPN suffix are enable and don't have conflict, but I can't logon using *.mycorp.com Alternative UPN.
Where I had my mistake?

Hi, Vivian,
I'm sorry, I should post my question after sleeping...
Just few hints.
I'm working with Windows Server 2012 R2 and it's a lab/test environment.
I read both articles you link about hundred time in last few days and all my configuration are like described.
I'l try to recap my situation and be more clear:
Forest A:
Domain: main.local (Parent)
Alternarive UPN: mycorp.com, child.mycorp.com
Domain: child.main.local (Child)
Alternative UPN: *came from parent domain"
Forest B:
Domain: test.local
Alternarive UPN: none.
Transitive Forest Trust between A & B Onedirection (Users in A can login/authenticate in B).
user1 is in Forest A/main.local
user2 is in Forest A/child.main.local
If I try to logon in "Forest B/test.local"as: MAIN\user1 or [email protected] everything it's ok and I can logon.
If I try to logon as: [email protected] it return me that user do not exist or password is wrong.
If I try to logon as: [email protected] it return me that user do not exist or password is wrong.
In "Active Directory Domain & Trust" under the propertie of the trust, under "Name Suffix Routing":
*.main.local (Enabled)
*.mycorp.com (Enabled)
But as I wrote, I can't logon using "*.mycorp.com" as suffix in truster domain, only "*.main.local" or "DOMAIN\user".

Exchange mailboxes, corporate AD, forest trust, arrays, Can you look this over?

This is my first script, it took a while to figure some things out, but it is working. I wanted to know if it is overkill, or if there is something that sticks out that would be an easier way of accomplishing something with this script.
Background info:
Company was bought out, forest trust set up between corp network and ours (years ago). So what we wanted was to compare exchange mailboxes with linked mailboxes array, to be compared to corporate AD array with user accounts that are disabled. a list is created
in another script which shows linked mailboxes and disabled corp AD accounts, helpdesk looks these through to make sure there are no exceptions. Exceptions are entered into PS cmdline, those are pulled out of the array. Then the left objects in the array are
PST backed up to network share, and then mailboxes removed. Admin trust across corp allows Exchange admin to search through Corp AD through search-AdAccount cmdlet. The script is run from a VM with exchange server tools installed and running 32-bit os of Windows
7 and 32-bit Office (Because that's how great... Exchange 2007 is for exporting mailboxes to PST).
Not sure of this, though it works:
<#Clear variables so they are not retaining any old values#>
Get-Variable -Exclude PWD,*Preference | Remove-Variable -EA 0
Wanted to clear variables before running script, data was being held over each run before adding this in
Here is the code "xxxxx" used in lieu of server names:
<#Import in modules, if statement for PSSnapin so that it doesn't throw an error if it is already loaded.#>
Import-Module ActiveDirectory
if ( (Get-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.Admin -ErrorAction SilentlyContinue) -eq $null )
add-pssnapin Microsoft.Exchange.Management.PowerShell.Admin
<#Clear variables so they are not retaining any old values#>
Get-Variable -Exclude PWD,*Preference | Remove-Variable -EA 0
<#Variables needed to complete script. $testIteration shows the number of times nested for loop happens, $exUserCorpMatch=@() is an empty array that will have objects added to it
when linked mailboxes on Exchange are compared to disabled corp accounts, the $adminUser and $adPW are the login credentials so that anyone can enter admin login credentials to run script#>
$errorLogPath = "c:\scripts\logs\exchangeADerror.txt"
$testIteration=0
$exUserCorpMatch=@()
$adminUser = whoami
$exceptionUsers=@()
$exceptionArray=@()
<#Create an Array from Get-mailbox cmdlet that has the value "LinkedMailbox" tying it to a Corporate account, .count value used to check results against expected#>
$mailboxes = Get-Mailbox -resultSize unlimited -RecipientTypeDetails LinkedMailbox
$mailboxes.count
<#Create an array of objects from Corp server of user only dissabled accounts, .count value used to check results against expected#>
$corpAccDis = Search-ADAccount -ResultSetSize $null -Server xxxxx -AccountDisabled -UsersOnly
$corpAccDis.count
<#Read in a list of users whose mailboxes shouldn't be removed#>
while ($var -ne "q"){
$var = Read-Host "Enter user exception linked mailbox name, or press q to quit entering names:"
if ($var -ne "q"){
$exceptionUsers += $var
$exceptionUsers.count
<#Create an Array with the usernames that were supplied by the Read-Host Cmdlet#>
foreach ($name in $exceptionUsers){
$exceptionArray += Get-Mailbox -Identity $name
$exceptionArray
<#Compare the two arrays on the value of name from the "Linked Master Account" and the Corp server "Sam Account Name" and insert the matching objects into an Array#>
For ($a=0 ; $a -le $mailboxes.count -1 ; $a++){
For ($b=0 ; $b -le $corpAccDis.count -1 ; $b++){
$testIteration++
if ($mailboxes[$a].LinkedMasterAccount.Split("\")[-1] -eq $corpAccDis[$b].SamAccountName){
$exUserCorpMatch += $mailboxes[$a]
break
$testIteration #Test value checking nember of times the loop took place
$exUserCorpMatch.count
<#For loop to take exception users mailboxes out of the script#>
For ($d=0;$d -lt $exceptionArray.Count; $d++){
$exUserCorpMatch = $exUserCorpMatch| ? {$_.alias -ne $exceptionArray[$d].alias}
$exUserCorpMatch.count
$exUserCorpMatch | sort
<#Taking the newly created array from the comparison and running the bulk of decisions, gives full access rights to the before entered admin account, then exports the mailbox to a PST
file on the network share, and produces a txt file of the users properties, attributes, etc.. Then removes-mailbox, this is cmdlet is currently commented out until testing is done and
confirmed removal is ready to take place. #>
for ($c = 0 ; $c -le $exUserCorpMatch.count -1; $c++){
$fileCreationTime = Get-Date -UFormat "%Y%m%d%H%M%S"
$displayName = $exUserCorpMatch[$c].DisplayName
$pstFolderPath = Join-Path "\\xxxxx\exchangePST\" $fileCreationTime$displayName.PST
$txtFolderPath = Join-Path "\\xxxxx\exchangePST\" $fileCreationTime$displayName.txt
try {
$everythingIsOk = $true
Add-MailboxPermission -Identity $exUserCorpMatch[$c] -User $adminUser -AccessRights FullAccess -ErrorAction Stop -Verbose
} catch {
$everythingIsOk = $false
Write-Warning "Permission add problem, logging error to $errorLogPath!"
Write-Warning $error[0]
$error[0] | Out-File $errorLogPath -Append
if ($everythingIsOk){
try{
Export-Mailbox -Identity $exUserCorpMatch[$c] -PSTFolderPath $pstFolderPath -ErrorAction Stop -Verbose
}catch{
$everythingIsOk = $false
Write-Warning "Export problem!"
Write-Warning $error[0]
$error[0] | Out-File $errorLogPath -Append
if ($everythingIsOk){
try {
Get-Mailbox -Identity $exUserCorpMatch[$c] | FL | Out-File $txtFolderPath -ErrorAction Stop -Verbose
} catch {
$everythingIsOk = $false
Write-Warning "Problem writing to txt"
Write-Warning $error[0]
$error[0] | Out-File $errorLogPath -Append
if ($everythingIsOk){
try{
Write-Verbose "!!!!!!!!!!!!!!!!!!"
<#Remove-Mailbox -Identity $exUserCorpMatch[$c] -Permanent $true -ErrorAction Stop -Verbose#>
} catch {
Write-Warning $error[0]
$error[0] | Out-File $errorLogPath -Append

Half of you code appears to be doing nothing.
This does nothing:
if ($everythingIsOk){
try{
Write-Verbose "!!!!!!!!!!!!!!!!!!"
<#Remove-Mailbox -Identity $exUserCorpMatch[$c] -Permanent $true -ErrorAction Stop -Verbose#>
} catch {
Write-Warning $error[0]
$error[0] | Out-File $errorLogPath -Append
The way we do a limiting Try/Catch is to just use a single "try/catch".
$fileCreationTime = Get-Date -UFormat "%Y%m%d%H%M%S"
for ($c = 0 ; $c -lt $exUserCorpMatch.count; $c++){
$displayName = $exUserCorpMatch[$c].DisplayName
$pstFolderPath = Join-Path "\\xxxxx\exchangePST\" $fileCreationTime$displayName.PST
$txtFolderPath = Join-Path "\\xxxxx\exchangePST\" $fileCreationTime$displayName.txt
try {
Add-MailboxPermission -Identity $exUserCorpMatch[$c] -User $adminUser -AccessRights FullAccess -ErrorAction Stop -Verbose
Get-Mailbox -Identity $exUserCorpMatch[$c] | FL | Out-File $txtFolderPath -ErrorAction Stop -Verbose
<#Remove-Mailbox -Identity $exUserCorpMatch[$c] -Permanent $true -ErrorAction Stop -Verbose#>
}catch
Write-Warning $error[0]
$error[0] | Out-File $errorLogPath -Append
The following does the same thing your code did. It executes but aborts further execution on an exception.
¯\_(ツ)_/¯

Auto discovery between forest trust.

HI,
We are merging to a company and set the forest trust. We are going to export our mail to their exchange and remove our exchange server.
We are login to our Domainold.com and currently outlook2010 clients are looking for our old domain exchange.
But how do i set this to go and find the New Exchange in our parent domain (newdomain.com) exchange and configure the client automatically?
AS

Hello Aussupport,
Currently your autodiscover URL is pointing to Old CAS servers, Please point to new CAS server, Please below command to set the required URL for Autodiscover Virtual directory, in below command , you can use Internal/external URL's how
you want
Set-AutodiscoverVirtualDirectory -Identity 'autodiscover (default Web site)' -ExternalUrl 'http://www.contoso.com'
like this please configure for all the virtual directries
always use external URL (ie FQDN of CAS form)
currently users are looking for Old RPC Client access server as their End point to access the mailbox resource, please point to new cas form

Single Label Domain - Corss Forest trust issue!

Hello There
We have a single label root domain ex: "abc" trying to establish the external trust with the other forest's root domain which is FQDN ex: xyz.com. The trust seems to be working fine from abc to xyz.com however the trust from xyz.com to abc is an
issue.
We are not able to resolve/ping domain abc from xyz.com DC. We are able to ping DCs in abc from xyz.com.
On xyz.com DNS forwarder are pointing to abc DNS server and WINS has been configured to route to abc WINS. Everytime when I ping abc from xyz.com DC its pointing to some unknown IP.
on the xyz.com DC tried setting up the registry key AllowSingleLabelDnsDomain, updated the LMHOSTS and host file with abc domain but still unable to resolve the single label domain. We could not suspect that its an issue with the network as we are able to
ping abc domain DCs from xyz.com
Thanks in advance.

Hi,
It’s not recommended to use LMHOSTS file. Instead, we can use conditional forwarders or secondary DNS zones for DNS resolution between the
two forests. Besides, we need to open required ports for building inter-forest trust.
Regarding how to configure name resolution between two forests, the following article can be referred to for more information.
Trust relationship between Two external forest / Name Resolution
http://social.technet.microsoft.com/Forums/windowsserver/en-US/f0f384c5-f421-4592-88db-409c171b0567/trust-relationship-between-two-external-forest-name-resolution?forum=winserverDS
Best regards,
Frank Shen

Move domain to another forest (forest trust)

Hello
I have a forest with many domains , and other forest with a domain. They include a trust set up and working . I would like to have only one forest, but it would need to move that single domain in additional forest, and would like to know if it is possible then
moving a domain from one forest to another forest in forest trust ?
Thanks also suggestions stop solve my problem

You're asking to move the domain itself? No, you can't move the domain. You can create a new domain in the forest you want to consolidate to, and then migrate users and groups to that forest. You'll have to migrate workstations and users and repoint
applications as well, if needed. And then, you're not really moving them, you are creating new ones and copying properties of those objects. You mentioned a forest trust but all the forest trust allows you to do is to assign/use permissions from one forest
in another. People speak of moving objects but like I said, for users and groups you're simply creating new ones with the same names, and copying properties over. Computers/servers are joined to the new domain, but it's a new computer account, not one that
gets moved over.
You'll need a migration tool to do this smoothly. As Malek mentioned ADMT, yes this is one tool that can do this. It's not necessarily the best or easiest tool, but it's free from Microsoft. There are also other third party tools such as Dell/Quest
Migration Manager for AD and BinaryTree also has similar tool (there are others out there too). Those two latter tools have the ability to add permissions (ACL entries) to new domain objects, based on the old ACLs from the source domain. This can be a huge
help for servers and workstations (allows the users to continue to use their same profile after their computer is migrated, and they are using their new user account. Otherwise Windows would just create a new profile when the user logged in with his/her new
domain account.
Depending on the size of the domain you want to move (how many objects), this could be a pretty big project. There's a lot going on in a migration, and based on your question, I'd recommend finding help with it if you can. There are a number of companies
and consultants who specialize in AD migrations, even some consultation for planning could help tremendously.

What difference between a domain trust and a forest trust?

What difference between a domain trust and a forest trust?

Greetings!
The answer is right on the question! :)
I think it is best to distinguish properly between forest and domain. This article is a good one:
What Are Domains and Forests?
But in a nutshell, a forest trust is mostly used between two organizations, Suppose company A has a unique forest and company B has another unique forest as well, when they are merged they can simply create a forest trust between each other, This trust can
be one-way or two-way depending on your needs.
Domain trusts are between a single instance (domain) of a forest to another instance (domain) of another forest. It is worth mentioning that trust can be transitive as well.
What Are Domain and Forest Trusts?
I hope you got the answer.
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or
to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Forest trust - security issues and how to avoid

Hi guys,
I have few questions.
1/Planning do Forest trust.We have Forest + Domain functional level at WS 2003 level.
In case of trust what are the security issues and how to avoid them? Meant something like browsing in AD, possible hacking from new destination etc.
2/ What in case that the trust will not be possible create because of security reasons (rejected by other company)? What can be an workaround for that? I have idea with resource forest or ADFS? Any other ideas?
Thanks in advance or for a good link to study about.
Petr Weiner

Other than broad general answers it is difficult to answer this from the negative side. I work in a very large company where we have hundreds of domains with one way trusts in place and I don't believe we have any security issues in place. With
the large numbers of domains we can't operate in any other fashion. We have a user forest and many resource forests. All of our domains and forests are operated and maintained within the company but if you have domains operated by different departments
then you can run into issues on who trusts. Also if you need to have a situation where you need to trust other companies then you start to look at ADFS, you can also use it internally for many applications as well as cloud services. But as I already
mentioned you haven't detailed what exactly is going on so it is hard to try and give you a concrete answer.
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.

ISE 1.2 Authentication fails for 2nd AD domain with the forest trust relation

We are running cisco ISE 1.2, we have new AD domain with forest trust relation between both the new and the old. authentication to with the new domain fails.
Is there any requirements or configurations change needs to be done to make it success?

Use the license that is currently on your ISE. If your account has access to download the software, then you are good. The license will not change during the upgrade. If you are using ISE 1.2 Patch 8 or above, then you are using the same Base/Plus?Apex Licensing model.
If you are not yet on Patch 8, the you are using Base/Advanced and these will be converted during the upgrade.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Set-up of a Forest Trust - Unique situation

Similar Messages

Maybe you are looking for