Trust Relationship stopped only one-way.

[SWalters]

I already posted this question a few days ago but never received a
reply. I figured it was a decent question so maybe the subject wasn't
appealing.

Here is the infrastructure I'm working with...


Domain1 has multple sites connected via site-to-site Cisco VPN. Only one
of those sites has another server which is a domain controller. I'll
call the headquarters site DC1 and the remote sites DC DC2.

Domain2 has multiple sites connected via site-to-site Cisco VPN as well
but there are no other servers except for the headquarters.


I had previously had no problems with the External Trust relationship
between Domain1 and Domain2. But now Domain1 can "verify" the trust to
Domain2 but not the other way around.

I have a secondary forward lookup zone setup on both domains which
contain the opposing domains DNS information.

The error I get when I try to Verify Domain2 trust to Domain1 is "The
secure channel (SC) query on domain controller \\DC2.domain1.com of
domain Domain1.com to domain Domain2.com failed with error: There are
currently no logon servers available to service the logon request. An SC
reset will now be attempted.

THat reset fails as well.

Now...I can ping both DC's in Domain1 from DOmain2 via DNS name. I
thought it was odd that the error was coming up as trying to communicate
with the remote site's (on Domain1) domain controller and not the
headquarter with DC1.

I cannot find any solution to this problem. Does anybody have any
thoughts or ideas?

Thanks,

 

[dgabbard]

Check a few of the following.
Firewalls are usually the culprit - blocking port 135.

Are the DCs NT4, 2000, or 2003?
Look at restrictAnonymous, LMcompatibility as possible restrictions
preventing the connections.

 

[SWalters]

wrote:

Check a few of the following.
Firewalls are usually the culprit - blocking port 135.

First...thanks for replying.

See it worked with no problems for a long time. There were no changes,
as far as I know, to anything. The firewalls are all Cisco PIX and have
site-to-site VPN setup. No ports are blocked inside the VPN. It just
seems odd that it is referring to a domain controller in one of the
remote sites of Domain1 and not just the easiest path which is the
domain controller in Domain1, not one of it's remote branches.

Are the DCs NT4, 2000, or 2003?
Look at restrictAnonymous, LMcompatibility as possible restrictions
preventing the connections.

They are all WIndows 2000 Standard Server. I'm not sure where to look
for the above but as stated, nothing has changed and I'm the only person
who has access to those servers.

Any other thoughts growing from the statment I made above about the
remote branch DC being the one it's trying to communicate with for
creating this trust?

Thanks again,