westyghs

Hi, Turns out that this issue was created by 2 things: i) All the firewall rules were correct except one, which was set to UDP 135 when it should have been TCP 135. ii) After restoring the firewall rule above things seemed to work, but very inconsistently. i.e. One minute it was working, the next it wasn't. It turned out that this last issue was to do with the DCs at the new school having the incorrect time. For some reason they were about 8 minutes fast. I set the new school's DCs to look at the same NTP server as ours, and now it is all working OK. I've now managed to login to both domain using accounts from the other, and it is all working great. Moral of the story - check the time! D

Hi, Yes this was my initial worry too, but we are not going over the internet. Both school's are on LGfL's network, so we both use IP segments from the same class A range and traffic never actually goes out onto the WWW. I know it's now considered bad practice to use a .local end to your domain name, and it may prove problematic if I want to ever makes services available on the internet, but for the time being I think it shouldn't be preventing the trust from working. As I say, DNS resolution and creation of the trust worked OK. It just seems to be resolving AD objects that is the issue. D

Hi, Yes I can PING the FQDNs (imaginatively titled server01.newschool.local and server02.newschool.local). From those 2 I can also reach all 3 of myschool's DCs via their FQDN. D

Hi, Yeah I've given that option a go and it didn't seem to make any difference. D

Hi, Our school has become a MAT recently and one of the things we have to do in the IT department is setup a domain trust so that users at the new school can eventually use their traditional login details to access resources here. The domain names use the forms myschool.sch.uk and newschool.local. However I am having real issues getting the domain trust between the 2 working properly. So far I have: 1. Used OpenSSL to create certificates for all domain controllers involved in both domains. Installed these certificates and the relevant root certificate authority certs so that they can all use LDAP over SSL on port 636. 2. Setup firewall rules between the 2 sites based on Microsofft's documentation here: https://support.microsoft.com/en-gb/help/179442/how-to-configure-a-firewall-for-domains-and-trusts 3. Setup the DNS so that _msdcs.newschool.local and newschool,local are available here as secondary zones, and setup myschool.sch.uk and _msdcs.myschool.sch.uk as secondary zones on the new school's DCs. These zones are transferring and replicating OK, and I can resolve DNS names for both domains on all servers in both locations. 4. Setup a domain trust (Trust type= forest, 2 way, transitive). I have enabled Kerberos AES encryption on both ends as all DCs are 2012 R2 or newer. I have also validated the trust using Active Directory Domains & Trusts, at both ends on multiple DCs and clients; all receive the result "The trust has been validated. It is in place and active." Now I want to add user and groups to certain roles, however I keep receiving errors stating that the domain controllers required to find the objects I want are not available. This is really odd because the MMC resolves the full domain name for a user or group when I partially type it in and click "Check Names". I have attached a picture of this error, and as you'll be able to see, the GUI is displaying the full name of the user object, and I only typed in the first 3 letters of the username and clicked "Check Names". So, the server is sending the request over to newschool.local and retrieving the user account details, populating the box but then generating an error that it could not contact the domain controller. All the DCs respond to PINGS, so ICMP is actively working between the 2 sites. Run a DCDIAG on all servers, and apart from minor eventlog replication issues, all AD services appear to be functioning properly. I also ran the command remotely on servers from my local machine to make sure that remote functionality was behaving itself, and this generated the same positive results. Any support documentation on the MS site points to DNS issues being the main cause, but as I mentioned above, DNS is replicating, updating and behaving as it should. All relevant servers for AD services are contactable and listed in DNS correctly. Any advice or suggestions would be much appreciated as I'm out of ideas now. Regards D

Cheers, thanks very much. Needed some reassurance I was on the right track, and you've done just that. You're help is much appreciated.

That sounds good, can you help point me in the right direction to get started please. e.g. Which components of SharePoint did you use to get started? Did you just create lists for data and then edit a page to act as the form etc. Thanks

Hi, I have promised to create an online order form for our new finance office as until now we have always had to complete forms to begin processing orders. The problem is, I offered without stopping to think what the best way to proceed would be. I thought "between access, Office 365 and our VLE I'll be able to rustle up something", except I've got to the point now where they've included it into next year's academic guide book making it policy (despite me even giving them a pilot or demo; which just gives you an idea of the drag-you-through-a-hedge-backwards-without-thinking-or-planning philosophy in the school). So, here I am; with 3 weeks to rustle up a solution and I'm not sure about the best way to proceed. Ideally I'd like to combine it with Office 365 in some way, as that already has usernames and account I can use for access; it also has integration with Excel, SharePoint and PowerApps; but I might be biting off more than I can chew with this approach. Would a simple set of Access tables and forms be the best way to do this still? I know that wouldn't take too long to develop, but it does seem a bit 2006.... Any idea or recommendations would be greatly appreciated. Thanks