Single Label Domain - Corss Forest trust issue!

Hello There
We have a single label root domain ex: "abc" trying to establish the external trust with the other forest's root domain which is FQDN ex: xyz.com. The trust seems to be working fine from abc to xyz.com however the trust from xyz.com to abc is an
issue.
We are not able to resolve/ping domain abc from xyz.com DC. We are able to ping DCs in abc from xyz.com.
On xyz.com DNS forwarder are pointing to abc DNS server and WINS has been configured to route to abc WINS. Everytime when I ping abc from xyz.com DC its pointing to some unknown IP.
on the xyz.com DC tried setting up the registry key AllowSingleLabelDnsDomain, updated the LMHOSTS and host file with abc domain but still unable to resolve the single label domain. We could not suspect that its an issue with the network as we are able to
ping abc domain DCs from xyz.com
Thanks in advance.

Hi,
It’s not recommended to use LMHOSTS file. Instead, we can use conditional forwarders or secondary DNS zones for DNS resolution between the
two forests. Besides, we need to open required ports for building inter-forest trust.
Regarding how to configure name resolution between two forests, the following article can be referred to for more information.
Trust relationship between Two external forest / Name Resolution
http://social.technet.microsoft.com/Forums/windowsserver/en-US/f0f384c5-f421-4592-88db-409c171b0567/trust-relationship-between-two-external-forest-name-resolution?forum=winserverDS
Best regards,
Frank Shen

Similar Messages

  • Trusted Forest (Single Label Domain)

    We have a forest "Domain1.com with SCCM 2012 R2 installed. This forest has a Trusted relation with another forest "Domain2". "Domain2" is "Single Label Domain"
    1) Could I discover computers on "Domain2" Domain??
    2) Must I configure "Domain2" Domain as "Disjoint Namespace" ??
    3) Must I configure something on "Domain1.com" ?

    Hi,
    Please make sure the specified account has Read permission to Domain2.
     And here is a blog about discover computers in another trusted domain, although it is for SCCM 2007. Hope this could be helpful.
    SCCM | Discover Another Trusted Domain
    Best Regards,
    Joyce Li
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Set up Migration Endpoint to single-label Domain/Forest

    I'm in the process of migrating a company from a single-label domain & forest, "domainname," to a new "newdomainname.local" domain & forest. EX2013 single-server installed and working on both domains, including autodiscover. Trust
    is set up and works, cross-domain DNS works from both sides. However...
    I can create a Migration Endpoint on ex2013.domainname that points to ex2013.newdomainname.local, but when I try to add a mailbox created in newdomainname.local, none are displayed.
    I can't create a Migration Endpoint at all on ex2013.newdomainname.local. I get a message that starts, "We couldn't detect your server settings. Please enter them. AutoDiscover failed with a configuration error: The migration service failed to detect
    the migration endpoint using the Autodiscover service."
    I'm prompted for the FQDN of the other Exchange server. When I enter ex2013.domainname, I get, "Error: The connection to the server 'ex2013.domainname' could not be completed."
    Is this expected when one server is on a single-label domain? Is there a way to enable me to use mailbox migration?
    TIA

    Thank you for your post.
    This is a quick note to let you know that we are performing research on this issue
    Niko Cheng
    TechNet Community Support

  • Support for Single Labeled Domain

    Question - When will Microsoft stop supporting "Single Label Domains"?  Now with Windows Server 8 in the horizon, I would like to know if it will let you upgrade your current AD infrastructure if it is setup as a Single Label Domain.

    I'm sorry, but I truly don't know. The reason that I don't know, is I've never tested it or let an AD infrastructure remain as a single label name for this length of time. I've fixed a number of them in the distant past with renames. I'm not aware of anyone
    currently with a single label name until I saw this thread.
    From what I see, I don't really think so if it hasn't caused any issues up to this point.
    Besides, why do you want to bump the levels up? Is there something you are trying to introduce that requires the levels at 2008 R2? If it's DNS based, it may fail anyway due to the single label name, because the basis of the single label name is DNS *thinks*
    it's a TLD, such as "COM," "NET," etc. That's why it's problematic. DNS is hierarchal and requires a minimum of a two level domain name.
    So if you have a computer, called computer1, and your domain name is DOMAIN. Then the computer's FQDN is computer1.domain. But that looks like a domain name. Make sense?
    Anyway, I'm sure you've heard this and read that in my blog. I'm curious ... Will you be planning on renaming your domain?
    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
    This posting is provided AS-IS with no warranties or guarantees and confers no rights.

  • SCCM and Single Label Domains

    Hi,
    I have SCCM in DomainA.local. It's have trust to DomainB - it's the Single Label Domains.
    How can i add DomainB to SCCM and deploy client?
    Thanks.

    You can find the requirements for single label domains here:
    https://technet.microsoft.com/en-us/library/gg682077.aspx?f=255&MSPPError=-2147217396#BKMK_SupConfigSLD
    My Blog: http://www.petervanderwoude.nl/
    Follow me on twitter: pvanderwoude

  • Single Label domain names

    Greetz!
    I would like clarification on Single Label Domain names in SP 2013 web applications.
    When I set up my A record I can set the Name, FQDN and IP Address. If I leave Name blank it will use whatever is in the FQDN?When I enter the FQDN I should use something like "Company.Local" or "SP.Company.Local" and not "Company"
    When I set up my root Web Application, I will use the FQDN that I gave in the A record and I will not leave the ":80" on the end of it.
    My intention is to setup a single web application and run HNSCs off the default zone. I will use Windows Authentication with basic Kerberos. I'll have a root site collection but we won't be using it.
    Am I thinking straight about avoiding the use of single label domain names?
    Thanks!
    Love them all...regardless. - Buddha

    "Single Label Domain names" has specific meaning and that applies to Active Directory (SLDs are not supported by SharePoint).
    You will want to use an FQDN as your Host-Named Site Collections will be present underneath the root domain (e.g. if you create a Web Application using "root.company.com", your sites will be "portal.company.com", "teams.company.com",
    as a couple of examples). Your Web Application will be created without a host name (see PowerShell example here: https://technet.microsoft.com/en-us/library/cc424952.aspx#section2).
    Your "root.company.com", in my example, with be a path-based Site Collection as the "Root" Site Collection, which is required for all SharePoint Web Apps. That is described here: https://technet.microsoft.com/en-us/library/cc424952.aspx#section2b.
    They use the WFE URL, but I prefer using the FQDN.
    Another advantage of using FQDNs + SSL is that you don't have two different URLs for internal and external access, thus SharePoint Alerts will always have the correct URL, etc.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Forest Trust Issues (Group Membership Issues)

    OK - this is going to be long. I hope I am detailed enough.
    Four domains, each in their own forests:
    domain.w.com
    domain.x.com
    domain.y.com
    domain.z.com
    For the sake of everyone, I'll refer to each domain as "w" or "x", which would be domain.w.com and domain.x.com, respectively.
    Domains x, y, and z all have users that require access to resources on domain
    w. Remember - each domain is in its own forest.
    Three trusts were created on domain w. Since the users on domain w do not need any resources on the other domains, three "ONE-WAY:OUTGOING" trusts were created (one for each) via Active Directory Domains and
    Trusts on domain w. The option to create the trust (have it show up in Active Directory Domains and Trusts) in the other domains (in this case
    x, y, and z) was selected.
    After the trusts were created from domain w, the trusts were verified. Administrators on domain
    w could "verify" the trusts (using admin accounts created for them on the three trusted domains).
    Since everything looked good (domain w shows up as an incoming trust for the other three domains), permissions for specific users on domains
    x, y, and z were granted for a share in domain
    w.
    Only... that didn't happen. When attempting to change permissions on the share, administrators were able to change the working domain directory to either
    x, y, or z... but searching returned zero results. Zilch.
    *It should be noted that this scenario has been in place for quite some time now, and that all groups/users previously defined on the share (that belong to the three domains trusted by domain
    w) now all show up as SIDs.
    When attempting to verify (validate) the incoming trust on any of the three domains, the error "Windows cannot find an Active Directory Domain Controller for the domain.w.com domain. Verify that an AD DC is available and then try again."
    is returned.
    Pinging domain.w.com returns the correct address. Direct pings to both domain controllers on domain w
    is also working. Domain w can also do the same pings that I just listed to all three other domains with correct results.
    There is no firewall in between these forests.
    I am leaning towards a DNS or AD issue on the domain w side. This all occurred at once on the same day last week, and no changes were made on
    x, y, or z. Of course... domain
    w is another entity and they are saying they have no clue why its not working.
    Questions:
    Should I be able to verify the trust from x, y, or
    z to domain w?
    Why cant domain w see the users/groups in the other domains?
    Why does domain w validate the trust if the other three domains cant?
    Could this be caused by some setting in GPO having to do with LDAP security, signing requirements, or authentication settings?
    Any help is much appreciated.
    Chris

    Yes, this is related to DNS, from what you describe.
    The simplest way to configure this is to go to EACH dns server on both sides of the trust and configure it for a conditional forwarder of the others dns zone. 
    http://www.techrepublic.com/blog/windows-and-office/configuring-dns-forwarders-to-support-windows-server-2003-forest-trusts/501/
    Unless you have a root dns server for all four zones already.
    Paul Bergson
    MVP - Directory Services
    MCITP: Enterprise Administrator
    MCTS, MCT, MCSE, MCSA, Security, BS CSci
    2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
    Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
    Please no e-mails, any questions should be posted in the NewsGroup.
    This posting is provided AS IS with no warranties, and confers no rights.

  • Monitoring cross Forest and Domain that isnt trusted

    Hello,
    I am completely new to the SCOM product....and before i get too involved in setting up and configuring my test lab to evaluate id like to ask a question.
    I have 5 domains all in seperate forests in a data centre.
    Domain 1 is a management rack where Nagios lives, my Backup server lives - Hopefully SCOM will live and a few other management servers.
    Domain 2 belongs to one client on its own network, with routers/switches/firewall
    Domain 3 to another client - own network range, routers, firewall, switches.
    And so on - each domain and rack replicating the above setup.
    I have been advised by senior management that i cannot allow trust or forest relationships between any of them.
    However to get my other monitoring solutions working i have been allowed to open limited ports between each domains networks and firewalls to allow communication between the management rack and the client racks.
    I want to implement SCOM into Management Rack 1 and have it monitor all of the servers/network devices in the other 4 domains and forests via the agents and have it report and function just like it would in a single domain/forest setup.
    Is this possible please without having the domains and forests trusted?
    If so could somebody steer me in the right direction?
    Many Thanks

    Hi,
    I would suggest you install SCOM 2012 R2 Gateway Server in domain 2,3,4 and 5
    About Gateway Servers in Operations Manager
    http://technet.microsoft.com/en-us/library/hh212823.aspx
    Monitor Untrusted Agents with SCOM 2012: Implementation of a gateway server
    http://www.toolzz.com/?p=281
    Gateway Server:-Install for another untrusted domain
    http://scompanion.wordpress.com/2012/10/18/gateway-server-install-for-another-untrusted-domain/
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • What difference between a domain trust and a forest trust?

    What difference between a domain trust and a forest trust?

    Greetings!
    The answer is right on the question! :)
    I think it is best to distinguish properly between forest and domain. This article is a good one:
    What Are Domains and Forests?
    But in a nutshell, a forest trust is mostly used between two organizations, Suppose company A has a unique forest and company B has another unique forest as well, when they are merged they can simply create a forest trust between each other, This trust can
    be one-way or two-way depending on your needs.
    Domain trusts are between a single instance (domain) of a forest to another instance (domain) of another forest. It is worth mentioning that trust can be transitive as well.
    What Are Domain and Forest Trusts?
    I hope you got the answer.
    Regards.
    Mahdi Tehrani   |  
      |  
    www.mahditehrani.ir
    Please click on Propose As Answer or
    to mark this post as
    and helpful for other people.
    This posting is provided AS-IS with no warranties, and confers no rights.
    How to query members of 'Local Administrators' group in all computers?

  • ISE 1.2 Authentication fails for 2nd AD domain with the forest trust relation

    We are running cisco ISE 1.2, we have new AD domain with forest trust relation between both the new and the old. authentication to with the new domain fails.
    Is there any requirements or configurations change needs to be done to make it success?

    Use the license that is currently on your ISE.  If your account has access to download the software, then you are good.  The license will not change during the upgrade.  If you are using ISE 1.2 Patch 8 or above, then you are using the same Base/Plus?Apex Licensing model. 
    If you are not yet on Patch 8, the you are using Base/Advanced and these will be converted during the upgrade.
    Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question.  Otherwise, feel free to post follow-up questions.
    Charles Moreton

  • Resolving Single-Name Domain on DC

    So I have a domain lets call it CONTOSO its a single-label domain name. 
    I can currently join computers to the domain but when you do an NSLOOKUP for the domain it doesn't resolve. Im trying to figure out if theres something wrong with the DNS settings since no client not even the DC can resolve the domain name via NSLOOKUP.
    It also doesn't resolve if I add CONTOSO.local.
    Is this normal behavior? I am planning a domain migration to corp.contoso.com to get it as a FQDN and I have been unable to setup a trust between them eventhough I gone through setting up secondary zones and conditional forwarders.
    I think that there may be an issue with the forest dns records. If I run from the CONTOSO Domain Controller:
    nltest /dsgetfti:CONTOSO
    Geting forest trust information failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN
    But running:
    nltest /dsgetdc:CONTOSO
    Works properly.
    Any thoughts?

    Hi Jorge,
    Would you please run ipconfig/all
    command on the DC, then post out the results for further analyzing?
    Ipconfig
    http://technet.microsoft.com/en-us/library/bb490921.aspx
    Best Regards,
    Amy Wang

  • SCCM 2012 R2 and single lable domain

    Hello,
    we have a followng case: root forest domain is single label domain such as ABC, it has child domain CORP.ABC. In the technet article just a little information about it, it says what SCCM supports site systems and clients, can we install SCCM in the single
    lable domain? Or in the child domain when forest domain is single label domain? Will schema be extended without problems and MP data published?

    Extending the schema is independent of the domain being single labled.
    SLD restrictions are listed here:
    http://technet.microsoft.com/de-de/library/gg682077.aspx#BKMK_SupConfigSLD
    Torsten Meringer | http://www.mssccmfaq.de

  • Two-way forest trust between two (single domain) forests with multiple identical user ID's

    Domain and forest levels - Windows 2003 (they both have one 2008 R2 DC)
    We need to create a two-way forest trust between two separate single-domain forests. The problem is that these two forests already access each others resources through a S2S. Users have the same login names and passwords on both forests/domains. Now, we
    are combining their infrastructures and need to set up a trust. From what I'm reading, you can't create forest trusts if you have the same SIDs, user ID's, or computer name in each of the forests.
    I'm looking into AD migration tool to copy the userSIDs (SID history?) between forest/domain, deleting the user ID's in the domain we migrated from, and then setting up the trust, but I'm leery about doing it this way as there is no easy 'recovery' should
    something go wrong. 
    Any suggestions for the easiest way to setup this forest trust?

    Hi,
    To eliminate your worries, two user accounts have the same user name doesn’t mean that they have the same SID. Moreover, the user’s SID remains the same even after it has been renamed.
    The SID for domain account/group consists of a
    Domain Identifier and a Relative Identifier. Domain Identifier is unique in every domain within a forest, and a Relative Identifier is unique within domain. It is unlikely that two user accounts with or without the same account
    name from two forests have the same SID.
    The Technet article you mentioned is talking about duplicate SIDs instead of “duplicate computer name or user account”, I will submit a change request to Microsoft about this.
    If there are duplicate SIDs when you create forest trust, you need to delete one of them as the article guides.
    Here are some related articles below for your references:
    How Security Identifiers Work
    http://technet.microsoft.com/en-us/library/cc778824(v=WS.10).aspx
    Security Identifier Structure
    http://technet.microsoft.com/en-us/library/cc962011.aspx
    Security Identifier
    http://en.wikipedia.org/wiki/Security_Identifier
    I hope this helps.
    Amy Wang

  • Server 2012 R2 no longer able to query objects in a trusted domain over a Forest Trust using Selective Authentication

    I have a scenario in which our enterprise activation servers exist in a domain that is in a separate forest than our offices.  Currently all our domain controllers are 2008 R2 with domain and forest functional levels at 2008 R2.  We have set
    up two-way forest trusts with our office domains using selective authentication.  We then give the domain controllers from our licensing domain the "Allowed to Authenticate" right to the domain controllers in the office domain.  On the
    server 2008 R2 domain controllers in the office domain, we can browse to the appropriate objects in the licensing domain after being presented with an authentication window that allows us to enter credentials for the licensing domain.  However, after
    installing a 2012 R2 domain controller in an office domain, we can not use the 2012 domain controller to browse to the objects in the licensing domain.  It never asks for credentials for the licensing domain when we specify the objects we want to add
    from the licensing domain.  I simply states that the object can not be found.  When I look at the domain controller in the licensing domain, I see that the domain controller in the office domain is attempting to pass the credentials of the user that
    is logged on and this is failing since this user has no rights in the licensing domain.  I can still use a 2008 R2 domain controller in the office domain to add the rights and it works like it always has.  Can somebody tell me why this is happening
    and how to correct it?

    Hi,
    Based on my research, this is a known issue in Windows Server 2012 R2.
    According to the article below: “The Selective Authentication feature of selective trusts is
    not functional. Access to resources enabled by “Allowed to Authenticate” will fail. There is no workaround at this time”.
    Release Notes: Important Issues in Windows Server 2012 R2
    http://technet.microsoft.com/en-us/library/dn387077.aspx
    Best Regards,
    Amy Wang

  • Cisco ISE and forest trusts vs domain trusts

    Hi All,
    Is there any issues with forest trusts with Cisco ISE ?
    I have a customer that had external trusts and ISE was working ok for PEAP MSChapv2 user auth across domains.
    They recently removed external trusts and changed to forest trusts.  Now auth doesn't work.  Initial error was authc ok, authz fail.
    I can search and get lists of AD groups ok for the remote domain. 
    Using the attribute tab, I can't get attributes for users in remote domain.  I'm thinking since I can't see the memberof attribute, none of my authz pollicies will work.
    I have done "leave" and "join" domain again.
    In my lab, I have forest trusts and it actually works ok.  A previous poster talked about kerberos issues across forest trusts ?
    Cheers
    Peter. 

    http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_ug.pdf
    Kindly find the steps on the page no.170

Maybe you are looking for