RAS Access across domains

[SarahR]

I am mid migration from an NT 4 domain to a 2003 domain.
The domains have a 2 way trust relationship. RAS access is
to a w2k machine sitting in the NT4 domain. When dialling
in and logging on with a 2003 domain username and password
I get error 691 - invalid username or password. However a
similar trust relationship with another NT4 domain allows
the user to authenticate. What am I missing?

 

[Sam Salhi [MSFT]]

I will assume that you have already added the VPN/RAS/IAS machine to the RAS
and IAS servers group on the Win2k3Domain and give you this advice.Move your
VPN server to the Win2k3 domain, it's more secure there than in the NT4
domains
There ware some security enhancements done to Win2k3 DC that requires that
the VPN/IAS server to have encrypted LDAP traffic, (not the case for Win2k)
So you have 3 options
A) Move the RRAS/VPN/IAS machine to Win2k3 domain
B) Add a Win2k3 IAS server in the NT4 domain and forward the requests of
Win2k3 to an IAS server in WIN2k3 domain
C) Enable DsHuristics on the win2k3 domain (not recommended)