Trusted Forest (Single Label Domain)

We have a forest "Domain1.com with SCCM 2012 R2 installed. This forest has a Trusted relation with another forest "Domain2". "Domain2" is "Single Label Domain"
1) Could I discover computers on "Domain2" Domain??
2) Must I configure "Domain2" Domain as "Disjoint Namespace" ??
3) Must I configure something on "Domain1.com" ?

Hi,
Please make sure the specified account has Read permission to Domain2.
And here is a blog about discover computers in another trusted domain, although it is for SCCM 2007. Hope this could be helpful.
SCCM | Discover Another Trusted Domain
Best Regards,
Joyce Li
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

Single Label Domain - Corss Forest trust issue!

Hello There
We have a single label root domain ex: "abc" trying to establish the external trust with the other forest's root domain which is FQDN ex: xyz.com. The trust seems to be working fine from abc to xyz.com however the trust from xyz.com to abc is an
issue.
We are not able to resolve/ping domain abc from xyz.com DC. We are able to ping DCs in abc from xyz.com.
On xyz.com DNS forwarder are pointing to abc DNS server and WINS has been configured to route to abc WINS. Everytime when I ping abc from xyz.com DC its pointing to some unknown IP.
on the xyz.com DC tried setting up the registry key AllowSingleLabelDnsDomain, updated the LMHOSTS and host file with abc domain but still unable to resolve the single label domain. We could not suspect that its an issue with the network as we are able to
ping abc domain DCs from xyz.com
Thanks in advance.

Hi,
It’s not recommended to use LMHOSTS file. Instead, we can use conditional forwarders or secondary DNS zones for DNS resolution between the
two forests. Besides, we need to open required ports for building inter-forest trust.
Regarding how to configure name resolution between two forests, the following article can be referred to for more information.
Trust relationship between Two external forest / Name Resolution
http://social.technet.microsoft.com/Forums/windowsserver/en-US/f0f384c5-f421-4592-88db-409c171b0567/trust-relationship-between-two-external-forest-name-resolution?forum=winserverDS
Best regards,
Frank Shen

Set up Migration Endpoint to single-label Domain/Forest

I'm in the process of migrating a company from a single-label domain & forest, "domainname," to a new "newdomainname.local" domain & forest. EX2013 single-server installed and working on both domains, including autodiscover. Trust
is set up and works, cross-domain DNS works from both sides. However...
I can create a Migration Endpoint on ex2013.domainname that points to ex2013.newdomainname.local, but when I try to add a mailbox created in newdomainname.local, none are displayed.
I can't create a Migration Endpoint at all on ex2013.newdomainname.local. I get a message that starts, "We couldn't detect your server settings. Please enter them. AutoDiscover failed with a configuration error: The migration service failed to detect
the migration endpoint using the Autodiscover service."
I'm prompted for the FQDN of the other Exchange server. When I enter ex2013.domainname, I get, "Error: The connection to the server 'ex2013.domainname' could not be completed."
Is this expected when one server is on a single-label domain? Is there a way to enable me to use mailbox migration?
TIA

Thank you for your post.
This is a quick note to let you know that we are performing research on this issue
Niko Cheng
TechNet Community Support

SCCM and Single Label Domains

Hi,
I have SCCM in DomainA.local. It's have trust to DomainB - it's the Single Label Domains.
How can i add DomainB to SCCM and deploy client?
Thanks.

You can find the requirements for single label domains here:
https://technet.microsoft.com/en-us/library/gg682077.aspx?f=255&MSPPError=-2147217396#BKMK_SupConfigSLD
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Single Label domain names

Greetz!
I would like clarification on Single Label Domain names in SP 2013 web applications.
When I set up my A record I can set the Name, FQDN and IP Address. If I leave Name blank it will use whatever is in the FQDN?When I enter the FQDN I should use something like "Company.Local" or "SP.Company.Local" and not "Company"
When I set up my root Web Application, I will use the FQDN that I gave in the A record and I will not leave the ":80" on the end of it.
My intention is to setup a single web application and run HNSCs off the default zone. I will use Windows Authentication with basic Kerberos. I'll have a root site collection but we won't be using it.
Am I thinking straight about avoiding the use of single label domain names?
Thanks!
Love them all...regardless. - Buddha

"Single Label Domain names" has specific meaning and that applies to Active Directory (SLDs are not supported by SharePoint).
You will want to use an FQDN as your Host-Named Site Collections will be present underneath the root domain (e.g. if you create a Web Application using "root.company.com", your sites will be "portal.company.com", "teams.company.com",
as a couple of examples). Your Web Application will be created without a host name (see PowerShell example here: https://technet.microsoft.com/en-us/library/cc424952.aspx#section2).
Your "root.company.com", in my example, with be a path-based Site Collection as the "Root" Site Collection, which is required for all SharePoint Web Apps. That is described here: https://technet.microsoft.com/en-us/library/cc424952.aspx#section2b.
They use the WFE URL, but I prefer using the FQDN.
Another advantage of using FQDNs + SSL is that you don't have two different URLs for internal and external access, thus SharePoint Alerts will always have the correct URL, etc.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Support for Single Labeled Domain

Question - When will Microsoft stop supporting "Single Label Domains"? Now with Windows Server 8 in the horizon, I would like to know if it will let you upgrade your current AD infrastructure if it is setup as a Single Label Domain.

I'm sorry, but I truly don't know. The reason that I don't know, is I've never tested it or let an AD infrastructure remain as a single label name for this length of time. I've fixed a number of them in the distant past with renames. I'm not aware of anyone
currently with a single label name until I saw this thread.
From what I see, I don't really think so if it hasn't caused any issues up to this point.
Besides, why do you want to bump the levels up? Is there something you are trying to introduce that requires the levels at 2008 R2? If it's DNS based, it may fail anyway due to the single label name, because the basis of the single label name is DNS *thinks*
it's a TLD, such as "COM," "NET," etc. That's why it's problematic. DNS is hierarchal and requires a minimum of a two level domain name.
So if you have a computer, called computer1, and your domain name is DOMAIN. Then the computer's FQDN is computer1.domain. But that looks like a domain name. Make sense?
Anyway, I'm sure you've heard this and read that in my blog. I'm curious ... Will you be planning on renaming your domain?
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

Resolving Single-Name Domain on DC

So I have a domain lets call it CONTOSO its a single-label domain name.
I can currently join computers to the domain but when you do an NSLOOKUP for the domain it doesn't resolve. Im trying to figure out if theres something wrong with the DNS settings since no client not even the DC can resolve the domain name via NSLOOKUP.
It also doesn't resolve if I add CONTOSO.local.
Is this normal behavior? I am planning a domain migration to corp.contoso.com to get it as a FQDN and I have been unable to setup a trust between them eventhough I gone through setting up secondary zones and conditional forwarders.
I think that there may be an issue with the forest dns records. If I run from the CONTOSO Domain Controller:
nltest /dsgetfti:CONTOSO
Geting forest trust information failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN
But running:
nltest /dsgetdc:CONTOSO
Works properly.
Any thoughts?

Hi Jorge,
Would you please run ipconfig/all
command on the DC, then post out the results for further analyzing?
Ipconfig
http://technet.microsoft.com/en-us/library/bb490921.aspx
Best Regards,
Amy Wang

SCCM 2012 R2 and single lable domain

Hello,
we have a followng case: root forest domain is single label domain such as ABC, it has child domain CORP.ABC. In the technet article just a little information about it, it says what SCCM supports site systems and clients, can we install SCCM in the single
lable domain? Or in the child domain when forest domain is single label domain? Will schema be extended without problems and MP data published?

Extending the schema is independent of the domain being single labled.
SLD restrictions are listed here:
http://technet.microsoft.com/de-de/library/gg682077.aspx#BKMK_SupConfigSLD
Torsten Meringer | http://www.mssccmfaq.de

Pros and cons in setting AD domain trust into my AD domain for more than 10+ AD domain and some with same FQDN or label ?

Hi,
Can someone please share what is the pros and Cons of trusting AD domain for more than 10 different AD sites into my existing single domain forest let say ParentCompany.com ?
At the moment I only have one single forest AD domain with the Domain and Forest functionality Windows Server 2003. The main domain controller FSMO role holder is in the Data Center spread across three different VMs running on Windows Server 2008 R2.
The main/parent company has acquired smaller business chain of 15+ offices in which they have their own Domain Controller and also their own domain, sometimes they also got the same AD domain between them (no trust or whatsoever in those 15+ AD domain).
Sounds crazy but yes, there is no standardization in them or whoever manage their IT infrastructure previously.
I'm now considering what are the benefits of creating the AD domain and trust versus importing those AD objects into my domain and then decommission them.
No need to worry about Exchange Server since all of the user in those sites connecting to the RDS to my ParentCompany.com terminal servers.
My requirements or goal are as follows:
1. Simplify the AD domain structure & maintenance
2. Try to avoid the disruptions of the user in terms of downtime and selecting multiple different domain everytime they login to their PC or SharePoint sites.
any kind of help and suggestion would be greatly appreciated.
Thanks.
/* Server Support Specialist */

Can someone please share what is the pros and Cons of trusting AD domain for more than 10 different
AD sites into my existing single domain forest let say ParentCompany.com ?
I think you mean 10 AD domains.
Managing multiple domains can be difficult for administration. I usually recommend using a single domain in a single forest with OUs to separate resources whenever it is possible.
However, if you can't do that then you can simply create trust relationships between your domains. The advantage is that you can enable access to resources to different domains. I do not see cons here.
The main/parent company has acquired smaller business chain of 15+ offices in which they have
their own Domain Controller and also their own domain, sometimes they also got the same AD domain between them (no trust or whatsoever in those 15+ AD domain). Sounds crazy but yes, there is no standardization in them or whoever manage their IT infrastructure
previously.
I'm now considering what are the benefits of creating the AD domain and trust versus importing those
AD objects into my domain and then decommission them.
I would recommend consolidating your domains into a single one. ADMT is a migration tool that you can use. The advantage would be the ease of administration. Also, by having multiple DCs for the same domain across sites, you will take benefit of High Availability
of your and DRP.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

How many ADFS farms can you have in a single forest/single domain?

Hi
I may have some terminology incorrect...please let me know if I do. :)
My question is, how many ADFS farms can you have in a single forest/single domain? If you want to know why I am asking...please read on.
We have 1 ADFS Farm and we are looking adding services to it. However not every cloud vendor provides a "Identity Broker" with there services.
We have a consultant that is advising that we need to enable a SAML-based IdP-initiated single sign-on (SSO) ie using "IdpInitiatedSignOnPage"
However to do this we need to modify the ADFS website to have "drop down" list so the user can select the "Relying Party" and then authentication with them.
This means we are exposing a list of every company/party we have federated with. The exposure of this information, is deemed a security concern by our company....which I agree with.
So the consultant advises that we need a separate ADFS farm. I have searched online, but haven't found any information that confirms multiple ADFS farms can be implemented in a single forest/single domain.
Thanks for reading and if you have any other suggestions...I'd appreciate it.
Nyobi

This is not exactly FIM related question - there is ADFS forum available on Technet. However - technically there is no limit of ADFS farms in a forest \ domain. It is just a service which uses AD and is not altering it in any way or storing some forest-wide
information like Exchange. So you can setup two ADFS services in single forest - no problem.
If it is a best solution to your problem? I can't say with that limited information but maybe just customization of pages on ADFS side would be enough?
Tomek Onyszko, memberOf Predica FIM Team (http://www.predica.pl), IdAM knowledge provider @ http://blog.predica.pl

One way trust relationship between different domain windows server 2012 in different forest

I'd like to build trust correctly between the domains A.local and B.int. A.local is on a Windows 2012 . B.int is on a Windows 2012 . Both machines are
connected to the same LAN. The forest level in A.local
machine is Windows Server 2008 and The forest level in B.int
is Windows server 2012.
I want a one-way trust relationship, i.e. users from A.local gain access to B.local.
my problem it i create the trust put when i go to validate the trust between A.Local and B.int give me this error :
The secure channel (SC) reset on Active Directory Domain Controller \\dc2.B.int of domain B.int to domain A.Local failed with error: There are currently no logon servers available to service the logon request.
NOTE : Recently I
UPGRADE THE Active Directory FROM 2008 R2 TO 2012 and i ping on A.local to B.int
it is ping by name and IP but from b.int ping by IP JUST >>>
ihab

Hi,
yes i already do it the setup conditional forwarding between the 2 domains and
the firewall it is off
ihab

CRM2011/3: Outlook CRM Cient Issues with Dual Domain (trusted forest)

We currently have CRM2011 but are about to migrate to CRM2013 and then to CRM2015. We have a configuration issue that we not sure is supported and seek clarification from the community please.
Our CRM deployment is working fine with the browser and Outlook CRM client on our single AD. Recently we have started allowing user within another AD to use our CRM. We have done this by setting up a bidirectional trust between the two domains.
Users from the new domain can use CRM if we add their {domain}\{login} into the user entity by hand (the add multiple users feature cannot browser the trusted foreign domain).
With the browser everything is fine, the new user from the foreign domain get straight in without needing to re-authenticate.
However, we've not been able to install the Outlook CRM client for those users. Is this because they belong to another domain and the authentication is done differently to that of the browser.
Is this scenario supported? Does it require Claims Authentication to get foreign Outlook User to connect?
Any feedback gratefully received.

Exchange 2010 and 2013 coexisting in separate trusted AD Forests, same email domain.

Im in a bind here.
Here is my scenario: We have domain 1, lets call this old-domain.corp that has an exchange server 2010 with MBX, CAS and HT role. We created a new domain, lets call this new-domain.corp that we migrated all our users AD accounts using ADMT from our old domain
to our new-domain.corp. We have both domains trusted two way, and we converted all our mailboxes on our old exchange 2010 server in our old domain to “linked mailboxes” with the owners of the mailboxes belonging to their new-domain.corp accounts.
This all works well currently.
What im trying to do now is have mailboxes live natively in the new-domain.corp on the new exchange 2013 server (only MBX role) I just built, whilst still having mailboxes working on our old-domain.corp while we migrate the mailboxes to the new. What
is the best way to achieve this? Right now I can create new mailboxes on the new server and send emails (using owa), but receiving is an issue since once mail is routed to my exchange 2010 (old) server it doesn’t keep going to the new exchange 2013 server.
Some details
Exchange 2010 – old-domain.corp – MBX, CAS, HT – latest rollup and exchange updates as of a week ago.
Exchange 2013 – new-domain.corp trusted two way with old domain - MBX
140 users - Single email domain name space
All on premise
Thank you,

Hi
In your case first you would need to bring Exchange 2013 CAS into the new domain.
Point all the web services URL to the Exchange 2013 CAS server
Redirect your firewall to receive all the emails to Exchange 2013 server
Then you would need to preparemove request and then once the objects are created then you would need to run new move request to move all the mailboxes from old domain to the new domain
One good article for your reference
http://msexchangeguru.com/2013/11/03/e2013crossforestmigration/
Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you Check out my latest blog posts on http://exchangequery.com Thanks Sathish
(MVP)

Install Exchange server 2010 in Single forest Multiple AD domain Scenario

Hello Folks,
I am trying to install a new exchange 2010 server in an enviroment which never had exchange.
Below is the env details
1 Forest
3 AD domains
Coustmer's requirement is that he wants to install exchange in only domain and other domain will not have exchange server the domain A which has server install should host the exchange mailbox's for other 2 domains and also capable enough to handle
the mailflow of each domain with diffrent SMTP domain. Have done research but havent got the exact scenario.
Now i am confused on how to start with this project any feedback inputs would be of great help to me.
BR/Deepak

Exchange server is forest wide role, so it does not depend much on number of domains in the same forest. Usually, you install Exchange in forest root domain in your forest, and Exchange will host mailboxes from any user from entire forest. So, actually,
your scenario is supported by default :). Just go and install Exchange in one domain. As soon as you prepare other domains for Exchange recipients, you will be able to create mailboxes from all domains in your forest.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Damir

Client Certificate Mapping authentication using Active Directory across trusted forests

Hi,
We currently have a setup where the on-premises environment and the cloud environment are based on two separate forests linked by a 1-way trust, i.e., the exist in the on-premises AD and the 1-way trust allows them to use their
credentials to login to a cloud domain joined server. This works fine with the Windows authentication.
We are now looking at implementing a 2-Factor authentication using Certificate. The PKI infrastructure exists in the On-Premises Forest. The users are able to successfully login to on-premise servers configured with "AD CLient Certificate
Mapping".
However, we are unable to achieve the same functionality on the cloud domain joined servers. I would like to know
1. Is this possible?
2. If yes, what do we need to do to make this work.
Just to clarify, we are able to authenticate using certificates by enabling anonymous authentication. However, we are unable to do the same after turning on "Client Certificate Mapping authentication using Active Directory"

1. Yes!
2. Before answering this I need to know if your are trying to perform a smart card logon on a desktop/console or if you just want to use certificate based authentication in an application like using a web application with client certificate requirements
and mapping?
/Hasain
We will eventually need it for smartcard logon on to desktop/console. However, at present, I am trying to use this for certificate based authentication on a web application.
To simulate the scenario, I setup up two separate forests and established a trust between them.
I then setup a Windows PKI in one of the forests and issued a client certificate to a user.
I then setup a web server in both the forests and configured them for anonymous authentication with Client SSL requirement configured.
I setup a test ASP page to capture the Login Info on both the servers.
With the client and the server in the same forest, I got the following results
Login Info
LOGON_USER: CORP\ASmith
AUTH_USER: CORP\ASmith
AUTH_TYPE: SSL/PCT
With the client in the domain with the PKI and the server in the other Forest, I got the following response
Login Info
LOGON_USER:
AUTH_USER:
AUTH_TYPE:
I tried the configuration with the Anonymous Authentication turned off and the AD CLient Certificate mapping turned on.
With the client and the server in the same forest, I am able to login to the default page. However, with the server in a trusted forest, I get the following error.
401 - Unauthorized: Access is denied due to invalid credentials.
You do not have permission to view this directory or page using the credentials that you supplied

Trusted Forest (Single Label Domain)

Similar Messages

Maybe you are looking for