Multiple domain 2003 and 2000

[KL]

I have a requirement allowing user to log onto 2 different domains say
domain A and domain B which are on a different forest.

It seems to me by establishing trust between 2 domains both running
under Window 2000, then it will work, but when one of the domain is a
Window 2003, it will not.

Is this a limitation or there are some special configuration I have to
put in to make it work.

KL

 

[LarsK]

I have a requirement allowing user to log onto 2 different domains say
domain A and domain B which are on a different forest.

It seems to me by establishing trust between 2 domains both running
under Window 2000, then it will work, but when one of the domain is a
Window 2003, it will not.

Is this a limitation or there are some special configuration I have to

no it works,
you go to the w2003 DC -> MMC -> Domains and Trusts.
you can not create forst root trust, becaus the forset must work at W2003
function level, but you can create "external Trust"
make shure that the DNS config works...

 

[Ace Fekay [MVP]]

In

no it works,
you go to the w2003 DC -> MMC -> Domains and Trusts.
you can not create forst root trust, becaus the forset must work at
W2003 function level, but you can create "external Trust"
make shure that the DNS config works...

As well as NetBIOS resolution, since external trusts soley rely on NetBIOS
resolution, (hence uses NTLM for authentication), and resolution is NOT DNS
based.

Only Forest trusts work using DNS, but that is only between two forests that
are Windows 2003 Forests and both forests are in 2003 Functional Levels.
This type of trust uses Kerberos for the authentication mechansim, which
relies on DNS.

If there are any questions concerning my above claims, please read these
articles, it is clearly stated:

HOW TO Establish Trusts with a Windows NT-Based Domain in Windows 2000
(Q308195):
http://support.microsoft.com/?id=308195

Cannot Use Kerberos Trust Relationships Between Two Forests in Windows 2000:
http://support.microsoft.com/default.aspx?scid=kb;en-us;274438

AD Cookbook, includes trust info, NTLM, and how NTLM uses NetBIOS.
http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/cookbook/cookchp2.mspx

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

If this post is viewed at a non-Microsoft community website, and you were to
respond to it through that community's website, I may not see your reply
unless that website posts replies back to the original Microsoft forum.
Therefore, please direct all replies ONLY to the Microsoft public newsgroup
this thread originated in so all can benefit or ensure the web community
posts it back to the original forum.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Windows Server Directory Services
Microsoft Certified Trainer
Infinite Diversities in Infinite Combinations.
=================================