Traffic between AD DCs in child domain and AD DCs in other forest

Hello, fellows.
I feel really stupid: cannot find a definitive answer on a very simple question. Let's say, there is on forest (F1) with two domains: forest root (F1-RDOMAIN) and a child domain (F1-CDOMAIN), single tree. There is another forest (F2) with only single domain
F2-RDOMAIN. If I setup two-way forest transitive trust between F1 and F2 forests, I know that some firewall ports must be open to allow communication between DCs in F1-RDOMAIN and F2-RDOMAIN. However, what I cannot say for sure whether there will any traffic
between F1-CDOMAIN and F2-RDOMAIN! Do I need to open the firewall ports between them as well? Let's assume that DNS servers in F1-CDOMAIN forward requests to DNS servers in F1-RDOMAIN, all domains have GCs.
Could someone refer me to the MS KB or something else that would say: "...all DCs must communicate with each other" or "only DCs in the root forests domains", please?
Many thanks in advance,
Rustam.

You do not need to open for direct communication between F1-CDOMAIN-DC and F2-RDOMAIN-DC, but workstations located in F1-CDOMAIN must be allowed to communicate with DC in F2-RDOMAIN if they are going to access resources that reside in F2-RDOMAIN. Take
a look at this description
of authentication process for more info.
Gleb.

Similar Messages

Any speed difference between Apple Wifi Router(air express) and Tp link(or others) wifi router)

Any speed difference between Apple Wifi Router(air express) and Tp link(or others) wifi router?
I'm using a tp link router and sometimes it takes a long time delay for my 2 mac computers to connect each other. I don't know this is because of the router compability or the computers.

Anyone knows?

What are the differences between a 2nd generation Airport Extreme and a 5th generation other than dual band capability?

I have a 2nd generation and want to replace it with a 5th generation. Will it be worth it? Other than the dual band capability of the 5th gen, what is the advantage?

The 2nd Gen AirPort will support wireless speeds up to about 270-300 Mbps. The 5th Gen will go up to 400-450 Mbps.
But, not sure why you are looking at a 5th Gen AirPort when the Gen 6 runs circles around the Gen 5 in terms of speed capability and antenna performance. The 6th Gen antennas are up at the top of the tower for significantly better transmission capability and there are more of them as well.
With an "ac" capable computer the 6th Gen will get up to 900-1,000 Mbps. Otherwise, it will come in at 400-450 Mbps with a fairly up to date Mac.
The 6th Gen would be, and is a "no brainer" for me over the 5th Gen, but you may have your reasons.
Apple tends to introduce new models in June of most years, so if you are not in a rush, you will likely have an even better offering soon.

How to see and add usernames from other forest in User Profile Synchronization

Hello Community
    Using Sharepoint 2010 Server there are 2 forests each containing their
domain users, lets call them Forest1/Domain1 and Forest2/Domain2 and their
is a one-way trust relationship between the two forests.
    The users are in Forest2/Domain2 but Sharepoint is on Forest1/Domain1. The
only way I have been able to add the users from Forest2\Domain2 to the Forest1\Domain1
has been to create a domain local group and an OU in Forest1\Domain1 and then put the
domain local group into the OU so that I can perform a UPS Synchronization on those
users (I also create a group on the Sharepoint 2010 Server add the users there too).
    The problem is that when I run the UPS Synchronization I can select the
checkbox for the domain local group but the individual usernames are not displayed in the
Synchronization process of populate container.
    The only names that get Synchronized are the Sharepoint Service Accounts and
the usernames that were created in Forest1\Domain1 AD.
    Consequently when users in Forest2\Domain2 logon they can access the intranet web appl
in Forest1\Domain1 by entering the url in the address box, but they cannot create a
My Site when the click their username because they get an error stating:
    "This page can't be displayed".
    But username created in Forest1\Domain1 can access the intranet web appl and
can create a My Site.
    I noticed that the difference is when users from Forest2\Domain2 get the error message
in the address box I see the My site url but it is missing "default.aspx" page which is
the page that contains My Content and My Profile and is the page that can't be displayed.
    But the users from Forest1\Domain1 have the My Site url in the address box with
"default.aspx" appended and therefore can create their My Site.
    The other problem is that when I go to the My Site url page and I go to People
and groups, I can add the OU that was Synchronized but I guess since I didn't see the
individual usernames I can't add the users from Forest2\Domain2 from the people picker
because the people picker error says:
   "no match found".
    But the people picker finds the users created in Forest1\Domain1.
    How do I make usernames visible when Synchronizing those usernames in the UPS Synchronization
process and be able to find them in people picker?
    Thank you
    Shabeaut

stsadm -o setapppassword -password<password
stsadm -o setproperty -url <url> -pn “peoplepicker-searchadforests” -pv “forest:<source forest>;domain:<trusted domain>,<trusted domain>\<account>,<password>“

Enter the forest and it locks me out of entering the domain controller or any child domains

Using Windows Server 2008 R2 SP1, no matter if I use the Graphical User Interface (GUI) or the Answer Method to enter the forest and it locks me out of entering the domain controller or any child domains.
Is there a remedy to this?

Hi Philo,
Would you please tell us that how did you try to enter the forest?
Are you able to run dcpromo to add domain controllers or create child domain?
Best Regards,
Amy

Puzzled - parent domain user as administrator in child domain cannot add printer

I've got a bare domain at the forest with 3 users and several "child" domains. I'm trying to set it up so that the user (let's call it EA-Service) in the forest can do administrative work in each of the sub domains without having to log on to the various
domains as each domain's domain administrator. There are a handful of these domains at this time, but as we pick up more accounts (think hosting), we expect the number of domains to reach the hundreds. I don't want hundreds of domain accounts
to track.
I thought adding EA-Service to a forest group called EA-Universal and adding EA-Universal to Builtin\Administrators on each of the domain controllers would give me administrator access on each of the domains.
I spent a frustrating two days trying to add an internet printer's driver using EA-Service on one of the child domains and it kept failing (message wasn't clear). Today I said, What the Heck, logon with my domain admin account on the child domain and
try. It worked. I dropped the printer and then logged out and back in with my EA-Service account and I couldn't do it. Clearly Builtin\Administrator isn't everything on a DC.
What right, privilege, or piece of arcane magic did the domain administrator account have that the EA-Service account did not? And how can I give that special whatever-it-might-be to my EA-Service account?
How can I determine exactly what rights & privileges a particular userid on a machine has? I could then compare the two sets of rights and see what was different.
I really need to have a super-duper-administrator account to do various maintenance tasks and I don't want to have to use each domain's Admin account to do it.
Can y'all help me?
-g

I had an entire post built that took me all day with interruptions and poof, it's gone. Rats. Here is my second attempt:
Assign permission on the resource using DL group.
This last one is the one I'm having trouble with.
I have to admint that I'm feeling very stupid about this whole thing. Everyone seems to understand it completely. I have read many posts and believe I understand them, but I'm not getting something as I've certainly not got it to work.
I have seen some excellent writeup by Ace, Awinish, Meinolf that have really helped me understand the RBAC/AGUDLP/IGDLA. This
post by Ace Fekay is one such example among others. I have read about the different group types and scopes. I have read about rights, privileges and permissions. I believe I understand them. I've worked in security since IBM's
RACF which is also RBAC.
The problem is just what permissions need to be given to DA-DomainLocal (the group to which EA-Service, the forest user, ultimately belongs) so that its members have the same abilities as DA-Service (a domain administrator account on a child domain)?
Clearly adding to Administrators on the child AD is insufficient as the EA-Service ID was directly added to it and it could not add a printer while DA-Service could. EA-Service is also a member of the Enterprise Admins group on the parent/forest domain.
What other permissions/rights/privileges does the DA-DomainLocal group (or directly, the EA-Service ID) still lack? What are the differences between the access tokens/descriptors of EA-Service and DA-Service? And how do I find out?
I believe I've seen some tool that showed them, but I can't seem to find it now that I'm looking.
I listed the NTFS permissions (via AccessEnum from SysInternals) for the entire C drive and note that Administrators is on most of them and not once did I see something like Domain Admins appear and I saw nothing to do with printers at all. The list
was very long so I could have missed it if it was there. I also used the same tool to look at the HKLM hive, but that was too large to browse through.
I have set up the group structure exactly as Awinish suggested and remain stuck at the last piece. If it was some specific resource I'd have no problem, I could add it, give it permissions/rights/privileges as needful. The problem remains is
that I don't know what those permissions/rights/privileges are nor how to discover a definitive list (I've seen some generic lists, but they don't list the exact names of the right/privileges).
I'm sure I'm just being dumb.
How do I go about discovering what permissions/rights/privileges that DA-Service has that EA-Service (via the DA-DomainLocal group) needs?
I thank all of you for helping me. I appreciate the time you are taking.
-g

Cisco ASA IPsec encrypt selective traffic between peers

Hello i have aproximately this topology:
192.168.13.0/24 ----> ASA1 (Public IP 10.1.1.2) ---> ISP1 <----> ISP2 --->ASA2 (Public IP 10.1.2.2) ---->192.168.4.0/24
Both ASA are 55xx
I've setup IPsec site-to-site vpn between these two ASA and now the net 192.168.13.0/24 is able to access the net 192.168.4.0 and vice versa.
Now, I want to access the ASA2 with via SNMP from 192.168.13.0 but it seems that ISP1 or ISP2 blocks UDP port 161 ...
Now my question:
can I encrypt the traffic between 192.168.13.0/24 and 10.1.2.2 ?
I tried to add NAT and VPN ACL an entries like this:
ASA1:
permit from net 192.168.13.0/24 to host 10.1.2.2
no nat from net 192.168.13.0/24 to host 10.1.2.2
ASA2:
permit from host 10.1.2.2 to net 192.168.13.0/24
After this setup I watch in ASDM / monitoring / VPN Session Details:
ASA1
Local Addr: 192.168.13.0/24
RemoteAddr: 10.1.2.2
Bytes TX: 46036
Bytes RX: 0
ASA2
Local Addr: 10.1.2.2
RemoteAddr: 192.168.13.0/24
Bytes TX: 0
Bytes RX: 45144
From log debugging I watch that the ICMP and SNMP packets from 192.168.13.0/24 arive to 10.1.2.2, but it seems that ASA2 doesn't repply... Any idea ?
ASA2 config:
route ISP2 192.168.13.0 255.255.255.0 10.1.1.2
crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac
access-list ISP2_cryptomap line 1 extended permit ip 192.168.4.0 255.255.255.0 192.168.13.0 255.255.255.0
access-list ISP2_cryptomap line 1 extended permit ip host 10.1.2.2 192.168.13.0 255.255.255.0
crypto map ISP2_map4 1 match address ISP2_cryptomap
crypto map ISP2_map4 1 set peer 10.1.1.2
crypto map ISP2_map4 1 set ikev1 transform-set FirstSet
crypto map ISP2_map4 1 set security-association lifetime seconds 86400
crypto map ISP2_map4 interface ISP2
crypto ikev1 enable ISP2
crypto ikev1 am-disable
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 10.1.1.2 type ipsec-l2l
tunnel-group 10.1.1.2 ipsec-attributes
ikev1 pre-shared-key *****
ASA1 Config:
route ISP1 10.1.2.2 255.255.255.255 10.1.1.1
access-list ISP1_cryptomap line 1 extended permit ip 192.168.13.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list ISP1_cryptomap line 1 extended permit ip 192.168.13.0 255.255.255.0 host 5.56.103.111
crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac
crypto map ISP1_map4 1 match address ISP1_cryptomap
crypto map ISP1_map4 1 set peer 10.1.2.2
crypto map ISP1_map4 1 set ikev1 transform-set FirstSet
crypto map ISP1_map4 1 set security-association lifetime seconds 86400
crypto map ISP1_map4 interface ISP1
crypto ikev1 enable ISP1
crypto ikev1 am-disable
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group 10.1.2.2 type ipsec-l2l
tunnel-group 10.1.2.2 ipsec-attributes
ikev1 pre-shared-key *****

LAN behind ASA is 192.168.50.0/24, but i need have comunication between
192.168.211.0/24 and 192.168.212.0/24
I have ACL in both direction because i need initialize connection from both sides:
192.168.211.0/24 <-> 192.168.212.0/24
i have both acl becasue i have two peers:
crypto map SDM_CMAP_1 211 match address test-p1-p2
crypto map SDM_CMAP_1 211 set peer 8.8.8.8
crypto map SDM_CMAP_1 212 match address test-p2-p1
crypto map SDM_CMAP_1 212 set peer 8.8.4.4
i removed :
route outside 192.168.211.0 255.255.255.0 194.146.123.1 1
but it didn't help
packet-tracer input outside icmp 192.168.211.1 0 3 192.168.212.1
Phase: 8
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0xd83fd240, priority=70, domain=encrypt, deny=false
        hits=81, user_data=0x0, cs_id=0xd7b688c8, reverse, flags=0x0, protocol=0
        src ip=192.168.211.0, mask=255.255.255.0, port=0
        dst ip=192.168.212.0, mask=255.255.255.0, port=0, dscp=0x0

User Folders in a Parent / Child Domain Structure

Hi,
I have a forest setup with a parent and 3 child domains.
We have a DFS share setup for home folders.
I used Group Policy to create the User's share folders, map the drive, and setup folder redirection.
Each user has a separate ID for each domain.
The desire is for each user to be able to use the same \\parent.com\home\%logonuser% share path from each domain in order to access files from any domain, and have privacy from other users doing so.
The problem I have is, after "child1\JohnD" signs into a workstation on domain CHILD1.com, his folder is created at "\\parent.com\home\JohnD" and mapped.
But if child2\JohnD then signs into domain CHILD2.com, he does not have permissions to map the drive.
I realize why, but I'm wondering if anyone can think of a way to change this setup so that parent\JohnD, and child1\2\3\JohnD, all have rights to map and use the same Home Folder.
Having domain specific home folders has been shot down.
Giving all shares EVERYONE access has been shot down.
Open to other suggestions.
Thanks!
-Matt
There's no place like 127.0.0.1

You might want to try creating a script that will grant the required rights to both user accounts using Powershell: http://blogs.technet.com/b/heyscriptingguy/archive/2014/11/22/weekend-scripter-use-powershell-to-get-add-and-remove-ntfs-permissions.aspx
Once you create the script, you can schedule it using Task Scheduler.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile
Interesting. I've been playing with this module off and on today. From what I can tell, this would have to be scripted to some sort of function like this:
dir \\parent.com\dfshome | Get-NTFSAccess
For each dir in "\\parent.com\dfshome", set $folder
For each $folder where account = "childx\User", set $User
For each $User, Add-NTFSAccess: child1\$user, child2\$user, and child3\$user
(head scratch)
I'll give it some more thought. :)
Thanks!
There's no place like 127.0.0.1

Exchange mailbox creation for child domain

Hi Friend,'
I want to add a child domain,some thing like group.domain.com. We have an exchange 2013 in the network, my requirement is to create 50 users in the child domain and create mail accounts for this child domain users.
My main challenge is to create the CDC and my exchange have the name space domain.com and my CDC is group.domain.com,but i want to add users in mailserver for the CDC users as [email protected]
I know how to add additional suffix in exchange and AD :
http://www.sysguru.in/2014/09/creating-additional-suffixname-space-in.html
Is it possible to use the same scenario for my CDC users also?
Regards

Hi,
In your case, if you want to add additional suffix in your Exchange server in the child domain, you need to add the root domain as an accepted domain.
Here is an article about accepted domain for your reference.
Accepted domains
https://technet.microsoft.com/en-us/library/bb124423(v=exchg.150).aspx
Hope this can be helpful to you.
Best regards,
Amy Wang
TechNet Community Support

Child Domain Lync Installation

run enable-csadforest on root domain server. Any idea to do csadforest without install Lync deployment tools on root server?
check universal security group is added on root domain.
check child domain didn't replication the universal security group.
Run Enable-CsAdDomain -Domain chil.domain.com for enable child domain user to use Lync.
Any advise? how long time to replication the universal security group?
i will install Lync server into child domain and federation with office 365.
Thanks.

Hi,
Did you prepare schema successfully without issue?
You need to prepare the forest on a computer which joined to a domain as a member of the Enterprise Admins group for the forest root domain. You need to prepare the forest with the Lync Lync Server Deployment Wizard or the Lync server Management Shell cmdlets
directly. So you need to install the Lync deployment tools on one of the root server.
You are right, you must verify that global settings have been replicated before running domain preparation.
Please also login the child domain using the account which as a member of the Enterprise Admins group, the check if the replication happens or not.
Best Regards,
Eason Huang
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Eason Huang
TechNet Community Support

VDI 3 + Active Directory Child Domain Setup Question

Hi Everyone,
Quick question. Will this config work because I'm having some issues.
Domain A
Child Domains A.A, B.A, C.A, etc..
Kerbros is setup and pointing at domain A with admin account access.
VDI3 can see all the domains when I pull down the domain selector... however!... I can only log into the parent domain A. Attempts to log into child domains A.A, B.A, etc give me an 'Unknown user/password error'.
Will this config work? All child domains are part of the same forest which I thought was supported.
Many thanks in advanced for any replies.
Dono

Hello,
yes, forests with multiple child domains are supported and your configuration should be working.
In order to troubleshoot the problem, please follow the instructions at:
http://wikis.sun.com/display/VDI3/End-users+cannot+access+their+virtual+machines.
The cacao logs should contain more details about the error.
Thanks,
Katell

Enable new Child Domain in Lync Server 2013

Hello All,
We are running Lync server 2013 in the Root Domain test.local. There are number of child domain enabled for Lync service . Eg: abc.test.local , xyz.test.local etc. Now i have a requirement to create new child domain and enable it for lync service.
So i created a new child domain (site1.test.local), then from lync shell i run below command to enable it.
Enable-CsAdDomain
–Domain site1.test.local –report c:\users\lyncadmin\Report1.html
Then i add the new SIP domain in topology builder in SIP doamin and
Simple URLs and publish the topology.
On AD all users are created in OU so i run below command to give privileges on OU:
Grant-CsOUPermission -Domain site1.test.local -ObjectType "User" -OU "OU=SITEUsers,DC=Site1,DC=TEST,DC=LOCAL"
After all the step , when i try to login the new users, Users are not logging , in Lync client logs it is giving below error:
4005;reason="Destination URI either not enabled for SIP or does not exist";source="LYNCFE13-02.TEST.LOCAL"
Please help to solve this issue .

I can see my child domain accounts in Lync control panel (enable user section) and all accounts are enabled. If i run below command then it show result = failure. But my others account are working.
PS C:\Users\administrator> Test-CSRegistration -UserSipAddress [email protected] -TargetFQDN xxxx.xxxx.localTarget Fqdn : xxx.xxx.local Result: Failure Latency : 00:00:00Error Message : 504, Server time-out Diagnosis: ErrorCode=1045,Source=LYNCFE-00.xxxx.xxxx,Reason=Local edge server pool is out of service,port=5061,pool-size=2,pool=xxx-Edges.xxxx.local Microsoft.Rtc.Signaling.DiagnosticHeader
Other accounts are giving SUCCESS msg and running without any issue.

SCCM 2012 root domain client management from child domain

Hi All,
We have SCCM 2012 environment in Child domain and we would like to manage the root domain clients as well. we are using https mode. What all configuration do we need to make for root domain clients to monitor successfully from child domain.
Is it mandatory to create System Management container for the Root domain? if yes what all permission i need to give for that System Management container.
Do we need to enable Active directory forest discovery?
Regards,
Bhaskar K

No, you do not need to create the System Management container or publish info into it and no you do not need to enable forest discovery.
ConfigMgr ultimately does not care about AD. AD can be used by clients to help them locate services and configure themselves, but this can also be accomplished in other ways in ConfigMgr.
Jason | http://blog.configmgrftw.com | @jasonsandys

Establishing Lync Server 2013 on a Child Domain

Hi,
We want to establish Lync Server 2013 Enterprise Edition on a child-domain. I finished the installation. Now, if i add to users to child domain and enable from Lync Server Control Panel for test, users can be signed in. However, we use child domain for only
domain computers. We want to keep users on parent domain, not child domain.
I can enable users which are on parent domain, but users can not sign in. When i look Lync troobleshooting program, i got this error: "user is not sip enabled"
How can i solve this problem not adding users to child domain?

Check whether the SIP address is enabled for the user
Get-CSUser -Identity <Alias>
SipAddress : sip:[email protected]
Enable-CsUser –Identity "Raji" –RegistrarPool Pool01.Lync.com –SipAddress "sip:[email protected]" –SipDomain Lync.com
Verify the output
Get-CsAdUser | Select-Object DisplayName, SipAddress, UserPrincipalName
Or
Construct a SIP address using the user’s SamAccountName and domain name
The SamAccountName is the user’s logon name: it’s the kenmyer portion of litwareinc\kenmyer. To use the SamAccountName as the SIP address use the –SipAddressType parameter followed by the parameter value SamAccountName:
Enable-CsUser –Identity "Ken Myer" –RegistrarPool atl-cs-001.litwareinc.com –SipAddressType SamAccountName –SipDomain litwareinc.com
Note that you also need to include the –SipDomain parameter followed by the appropriate SIP domain. With both FirstLastName and SamAccountName you must explicitly indicate the SIP domain; Enable-CsUser won’t try to make a “best guess” at determining the domain
name for you.
Use the user’s email address as his or her SIP address
This is kind of a nice option: it simply grabs the user’s email address and uses that same value for his SIP address. (That way, users have just one address to remember.) To use this option, simply include the –SipAddressType parameter followed by the parameter
value EmailAddress:
Enable-CsUser –Identity "Ken Myer" –RegistrarPool atl-cs-001.litwareinc.com –SipAddressType EmailAddress
Reference: https://blogs.technet.com/b/csps/archive/2010/06/06/howtoenableusers.aspx
Exchange Queries

FRS to DFSR migration (Child domain)

Planning on migrating FRS to DFSR for a child domain, I know this is a per domain process.
It shouldn't matter which domain is migrated first, the child or root. But to doublecheck : The plan is to migrate they child domain and the root domain will take a couple of months before it's prepared. Does it matter? Even though i'm pretty certain it
doesn't matter because it's a per domain process, but wanted to verify.

> It shouldn't matter which domain is migrated first, the child or root.
No, it doesn't.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Traffic between AD DCs in child domain and AD DCs in other forest

Similar Messages

Maybe you are looking for