Folder Permissions on a Different Domain

[sqdge]

Is it possible for me to set folder permissions on one server for a user whose domain is on a different server?

 

We have a member of staff whose computer is tied to the Admin Server, however he needs to have access to a shared folder on the Curriculum server. At the moment, I can point his computer to the folder, but I can not get it to accept him as a valid modifier of the contents.

 

Any ideas?

[apeo]

Easy just go into the security and share tab and add that user in. You will need to change the location to the admin domain.

[sqdge]

Easy just go into the security and share tab and add that user in. You will need to change the location to the admin domain.

I tried that, but it didn't seem to accept it. It wasn't happy about including a user from a different domain.

[apeo]

Do you get an error when adding the user into the acl?

[ChrisH]

Would you not need a trust inplace somewhere for this to behave?

[azrael78]

You need a trust inplace so that the curriculum domain trusts the admin domain.

 

You have the option of a 1-way or 2-way trust, it won't harm anything if you use a 2-way trust - HOWEVER - you really need to double-check group policies and share/NTFS permissions before you do this. Anything with 'Authenticated Users' or 'Everyone' will suddenly apply to both your curriculum and admin domains.

 

A 1-way trust is just as good as 2-way (and can be converted later if you wanted) - it's just easier to remember how to create a 2-way than a 1-way.

 

In AD Domains and Trusts - you need to create a new outgoing trust from Curriculum to Admin so that the Curriculum domain TRUSTS the Admin domain.

 

(This might be round the wrong way, but it won't harm anything if it is, you can easily delete the trust and recreate)

 

Once your trust is established - give it a minute and try to add the member of staff again. However, to be honest - it may be a better idea to create a group, add the group to the share/folder and add the member of staff to the group (so any other staff who may need the same access, can be given it easily without having to dive into the file system or shares).

 

Hope this helps

 

Az

 

Edit: And I've just noticed the last post date/time... it's one of those days so far...