Help Required Setting Up Domain Trust

[westyghs]

Hi,

 

Our school has become a MAT recently and one of the things we have to do in the IT department is setup a domain trust so that users at the new school can eventually use their traditional login details to access resources here. The domain names use the forms myschool.sch.uk and newschool.local. However I am having real issues getting the domain trust between the 2 working properly. So far I have:

 

1. Used OpenSSL to create certificates for all domain controllers involved in both domains. Installed these certificates and the relevant root certificate authority certs so that they can all use LDAP over SSL on port 636.

 

2. Setup firewall rules between the 2 sites based on Microsofft's documentation here: https://support.microsoft.com/en-gb/help/179442/how-to-configure-a-firewall-for-domains-and-trusts

 

3. Setup the DNS so that _msdcs.newschool.local and newschool,local are available here as secondary zones, and setup myschool.sch.uk and _msdcs.myschool.sch.uk as secondary zones on the new school's DCs. These zones are transferring and replicating OK, and I can resolve DNS names for both domains on all servers in both locations.

 

4. Setup a domain trust (Trust type= forest, 2 way, transitive). I have enabled Kerberos AES encryption on both ends as all DCs are 2012 R2 or newer. I have also validated the trust using Active Directory Domains & Trusts, at both ends on multiple DCs and clients; all receive the result "The trust has been validated. It is in place and active."

 

Now I want to add user and groups to certain roles, however I keep receiving errors stating that the domain controllers required to find the objects I want are not available. This is really odd because the MMC resolves the full domain name for a user or group when I partially type it in and click "Check Names". I have attached a picture of this error, and as you'll be able to see, the GUI is displaying the full name of the user object, and I only typed in the first 3 letters of the username and clicked "Check Names". So, the server is sending the request over to newschool.local and retrieving the user account details, populating the box but then generating an error that it could not contact the domain controller. All the DCs respond to PINGS, so ICMP is actively working between the 2 sites.

 

Run a DCDIAG on all servers, and apart from minor eventlog replication issues, all AD services appear to be functioning properly. I also ran the command remotely on servers from my local machine to make sure that remote functionality was behaving itself, and this generated the same positive results.

 

Any support documentation on the MS site points to DNS issues being the main cause, but as I mentioned above, DNS is replicating, updating and behaving as it should. All relevant servers for AD services are contactable and listed in DNS correctly.

 

Any advice or suggestions would be much appreciated as I'm out of ideas now.

 

Regards

 

D

[HPlum78]

My first thought with no research is that all domains in the trust need to be routable.....

My second is around DNS forwarders....

Edited October 25, 2017 by HPlum78

[mavhc]

I wonder why it says .local, not .newschool.local....

 

Edit: Oh, you blanked that out, right.

 

Have you tried https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2016/11/22/dns-isnt-always-the-cause-of-selected-objects-in-the-following-domains-are-not-available/

[westyghs]

Hi,

 

Yeah I've given that option a go and it didn't seem to make any difference.

 

D

[HPlum78]

Some bed time reading https://technet.microsoft.com/en-us/library/cc773178(v=ws.10).aspx just in case you have not seen it....

[Michael]

Can you ping the server FQDN, rather than just the server IP?

[westyghs]

Hi,

 

Yes I can PING the FQDNs (imaginatively titled server01.newschool.local and server02.newschool.local). From those 2 I can also reach all 3 of myschool's DCs via their FQDN.

 

D

[westyghs]

Hi,

 

Yes this was my initial worry too, but we are not going over the internet. Both school's are on LGfL's network, so we both use IP segments from the same class A range and traffic never actually goes out onto the WWW.

 

I know it's now considered bad practice to use a .local end to your domain name, and it may prove problematic if I want to ever makes services available on the internet, but for the time being I think it shouldn't be preventing the trust from working. As I say, DNS resolution and creation of the trust worked OK. It just seems to be resolving AD objects that is the issue.

 

D

[Michael]

The only other issue I've had with Trusts, is servers with identical servernames, despite the FQDN being different. The NETBIOS name would of course be the same which is where the problem lies.

[westyghs]

Hi,

 

Turns out that this issue was created by 2 things:

 

i) All the firewall rules were correct except one, which was set to UDP 135 when it should have been TCP 135.

 

ii) After restoring the firewall rule above things seemed to work, but very inconsistently. i.e. One minute it was working, the next it wasn't. It turned out that this last issue was to do with the DCs at the new school having the incorrect time. For some reason they were about 8 minutes fast. I set the new school's DCs to look at the same NTP server as ours, and now it is all working OK.

 

I've now managed to login to both domain using accounts from the other, and it is all working great.

 

Moral of the story - check the time!

 

D

[mavhc]

Thanks for the update. You'd think by now time wouldn't be an issue, then you have VMs on HyperV and it goes wrong all over again