Windows 2003 AD and Authentication Domains

[Wallace, David K.]

I would like to create an additional authentication domain, but not a
physical domain with domain controllers etc.

My tree looks like this.

toplevel.com
dv.toplevel.com
corp.toplevel.com
pd.toplevel.com

I would like to create a "customers.toplevel.com" authentication domain to
allow some of my customer facing web applications to authenticate to Active
Directory, but I would them in a separate tree. Is there a way of doing
this?

Many thanks

David

 

[Joe Richards [MVP]]

An authentication domain is going to require a physical domain unless you are
simply thinking about setting up some UPNs for users that exist in one of the
other domains. You can set a user's UPN to pretty much anything you want. For
instance you could have (e-mail address removed)

 

[Wallace, David K.]

I'm looking for a seperate LDAP tree in Active Directory. I want to
seperate Tree from my corporate users to put my external customers in the
tree so they can log into our web site.

Does that make sense? I don't want any domain controllers in this domain,
just users.

THanks
David

 

[Joe Richards [MVP]]

You can't have a domain without domain controllers, they go hand in hand.

Depending on how you are authenticating users, you might be able to use ADAM
(Active Directory Application Mode) which is a standalone LDAP Server.

See

http://www.microsoft.com/windowsserver2003/adam/default.mspx