Software for Joining 2 Domains

[sqdge]

We have a computer in a our school that would be very useful if it had the ability to switch between the admin and curriculum domain. I know there is software out there that can do that (Multinetwork Manager, Netswitcher etc). However, being a cheapskate, I was wondering if anybody new of some free software that could also do that?

 

Cheers.

[Geoff]

Isn't a trust sufficient?

[sqdge]

Isn't a trust sufficient?

It would be in a normal environment. However, my school is anything but normal - the server does not accept the trust between the two servers...however, it is perfectly possible to ping and read each other's server.

[m25man]

sqdge

 

This is a common issue that I have responded to before on geek.

 

AD expects relationships to exists within forests or between related forests.

 

The old style of disparate NT Domains being trusted has all but disappeared.

 

In order to get two different domains to trust each other was made worse by the loss of LANMAN1 compatability after 2003 SP1

 

In order to get a trust relationship in place between two seperate 2003 domains do this!

 

Set the clocks so that they are in sync.

More than 5 mins and you have clock skew and keberos issues.

 

Make sure that you have setup split DNS correctly and that each DC/Global Cat server can ping each other by the FQDN eg.

server1.curric.local pings server2.admin.local and vice versa.

Use a hosts file if absolutely neccesary and if using VLANS make sure the servers are connected to ports servicing both VLANS.

 

Set up a Domain Admin Level account in both Domains that have the SAME USERNAME AND PASSWORD.

 

Using the Domains and Trusts MMC use this new account to setup the keberos trust relationship.

 

It is these cached credentials that will be used to exchange the current keberos key and enable the trust.

 

You can safely delete or disable this account after the trust is established, the servers will constanly update the keberos keys dynamically.

Only if there is a long term communications issue between the DC's will you ever need to re-establish the trust relationship.

 

I hope this helps solve your problem.

[m25man]

I forgot the important bit....

 

Once you have established your trust make sure you carry out a security audit to ensure that all the various bits of your network are secured from each other.

[zag]

Or you could just merge the 2 networks I don't see the point in having 2 seperate domains any more in an active directory environment.

[tosca925]

Or you could just merge the 2 networks I don't see the point in having 2 seperate domains any more in an active directory environment.

 

 

Exactly as we did................. havn't looked back since

[ajbritton]

Or you could just merge the 2 networks I don't see the point in having 2 seperate domains any more in an active directory environment.

 

Unless of course you want to have different password policies...

[lovelldr]

Or you could just merge the 2 networks I don't see the point in having 2 seperate domains any more in an active directory environment.

 

Unless of course you want to have different password policies...

 

In which case, you create a GPO for the different OUs you want to have the different polices, and setup the password policies for each GPO under Computer Config -> Windows Settings -> Security Settings -> Account Policies -> Password Policies

 

Surely that would do it? (Never tried it, but I guess it would?)

[Geoff]

Password polcies are domain wide settings. You cannot override them at the OU level.