Two forest (win2003) and access to printer resources

[Marlon Brown]

Public education institution, I have staff and student accounts. I am
planning to migrate to Win2003 and create a separate forest to accomodate
student accounts and enforce stronger password policies for the staff
accounts.

We have budget available to buy servers and join them to the student domain.
For staff/teachers that need to access student folders, I will make a one
trust student->staff. That way students won't be able to access the folders
or accounts on the staff domain.
Question is about printers:
Should I have to purchase separate printers for students to keep the student
domain/forest isolated, or if I create print spoolers on both staff and
student domain respective users can access the physical printer resource
without compromise security ?

 

[Brian Desmond [MVP]]

Marlon-

Personally, I wouldn't go with seperate forests. Seperate domains would work
in my eyes, but that's just my two cents.

As far as the printers, if you're going to go with two forests, just put the
print queues on a server in each domain. No security risk. Only issue is
that you won't have a true print queue as there will be two servers with a
queue for the printer, and thus you won't be able to truly prioritize jobs,
etc.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Marlon Brown]

Hey, when you say two domains, OK but then I would keep just the one way
trust relationship, right ?. I thought that Win2003 provided advantages by
doing this trust at forest level, but in case you know something about that,
please let me know.

 

[Brian Desmond [MVP]]

Marlon-

Trusts are transitive between multiple domains in a forest - they all trust
each other.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com