+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 16
Windows Thread, I don't trust my trusts in Technical; I have 2 domains, admin and curriculum, and a 2-way non-transitive trust set up between them (I need to have ...
  1. #1

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    I don't trust my trusts

    I have 2 domains, admin and curriculum, and a 2-way non-transitive trust set up between them (I need to have access to shares from both networks on both networks - don't ask!). I know a flat netowrk would be better and just as secure, etc.

    My trusts aint working though and I get errors about not being able to find the DCs, etc.

    Off I toddled to the MS website and it said to give netdiag a go but it keeps skipping the trust test, even using the command:

    Code:
    netdiag /debug /test:Trust
    Any help is appreciated.

  2. #2
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    5,013
    Thank Post
    120
    Thanked 283 Times in 261 Posts
    Rep Power
    108

    Re: I don't trust my trusts



    Sorry couldnt resist. Im in a funny mood after teh day Ive had :P

  3. #3

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: I don't trust my trusts

    Sounds like a DNS problem. Are the domains in the same forest?

  4. #4

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    Re: I don't trust my trusts

    Come on Geoff! One of thm is a Westfield configured admin domain!

    (For all those not in Lancashire - no)

  5. #5

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: I don't trust my trusts

    ok you'll need to add the DNS zone for the first domain as a stub zone to the second domain. You'll then need to do the reverse for the second domain.

    You'll also need to allow zone transfers.

  6. #6

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    Re: I don't trust my trusts

    I knew that I'd missed something - will maybe do it tomorrow (been at Lancaster Uni today).

  7. #7

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    Re: I don't trust my trusts

    Okay, tried to create a stub zone to no avail - I simply have a message returned that says:

    The zone cannot be created. The request is not supported.

    Any more ideas people?

    There may be another option to achieve my aim which is to simply have access to shared drivespace on each network from the other network (preferably without requiring further authentication).

  8. #8

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: I don't trust my trusts

    You didn't allow zone transfers.

  9. #9

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    Re: I don't trust my trusts

    Yes I did :P

    Zone transfers are allowed on all zones and to any server. I ensured that this was the case before beginning.

  10. #10

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: I don't trust my trusts

    ok, but do they work? Just because you allowed them doesn't mean they do. Check your security settings.

  11. #11

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    Re: I don't trust my trusts

    I still cannot create a stub zone, however I have been able to create a secondary zone.

    I have recreated my trust and Windows says that all is fine and dandy, however I cannot aa groups and users from my admin domain to the security permissions on my curriculum domain still. (I can do this on the admin domain with curriculum groups). It is a 2-way trust.

  12. #12

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: I don't trust my trusts

    And the event log says?

  13. #13

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    Re: I don't trust my trusts

    The only related error that I can see is:
    Product: Windows Operating System
    ID: 5719
    Source: NETLOGON
    Version: 5.0
    Symbolic Name: NELOG_NetlogonAuthNoDomainController
    Message: This computer was not able to set up a secure session with a domain controller in domain %1 due to the following:
    %2
    This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

    ADDITIONAL INFO
    If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.
    Running 'nltest /dclist:<admin domain name>' returns:
    Get list of DCs in domain '<admin domain name>' from '\\<admin server>'.<FQDN> [PDC] [DS] Site: <site-name>
    The command completed successfully

  14. #14

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,804
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: I don't trust my trusts

    Using a secondary zone implies the domains are in the same forest and therefore there is replication between the domain controllers.

  15. #15

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,600
    Thank Post
    109
    Thanked 769 Times in 598 Posts
    Rep Power
    181

    Re: I don't trust my trusts

    The way I understand it, a secondary zone is simply a copy of a primary zone on another server. Replication of DNS will occur but it is simply UDP packets - the stub zone was invented to reduce this traffic but since that isn't working for me, I cannot use it.

    There must be some permissions somewhere that are preventing my trust working in one direction. I just don't know how best to troubleshoot this since I haven't got much experience in the field of trusts.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Trust Relationships and DeepFreeze
    By AdamWilden in forum How do you do....it?
    Replies: 6
    Last Post: 4th February 2008, 11:16 AM
  2. Could you trust this website?
    By PEO in forum General Chat
    Replies: 4
    Last Post: 25th November 2007, 01:34 PM
  3. Inter Domain Trusts -- how do you do it
    By Hedghog in forum Windows
    Replies: 5
    Last Post: 4th November 2007, 09:15 PM
  4. DNS Problem - Domain Trust
    By mortstar in forum Wireless Networks
    Replies: 2
    Last Post: 17th August 2007, 10:19 AM
  5. Trust Help
    By Ric_ in forum Windows
    Replies: 7
    Last Post: 20th October 2005, 06:03 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •