Re: Child Domains
- From: "Herb Martin" <news@xxxxxxxxxxxxxx>
- Date: Mon, 10 Apr 2006 19:35:06 -0500
"D Warner" <DWarner@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:4A1644BE-2415-434A-88A2-8AA69531D707@xxxxxxxxxxxxxxxx
I have a parent domain at the corporate office. I have added a child
domain
at a remote site with 1 DC/GC. The remote site will have multipe Member
servers of the Child Domain. From the corporate office I want to log in
to a
member server of the child domain with my parent domain account.
Then you will be logging INTO your domain, to use resources
on the server or even to logon AT that server (e.g., with Terminal
Services.)
Is it
possible to for the member server do its authenication to the child's
Domain
Controller and not come back over the WAN to authenicate to the Parent's
DC?
That's not the way AD authentication works but it is
as good or better than you are assuming:
The Logon (wherever you logon) authenticates the
user in his/her OWN domain and provides both
Kerbors "ticket granting ticket" AND the normal
Windows Security Access Token.
When you access a server the CLIENT machine
will either use those existing credentials or get
a ticke (perhaps from another domain) to access
a server's resources.
With the child DC being a Global Catalog it should be able to do this
right?
Authentication is NOT done at a GC (in it's guise as a GC)
but by Domain Controllers.
Domain Controllers are also used to traverse the
"referrel path" for resource in other domains (i.e.,
other domain DCs are used.)
The issue is I don't want to open up all the AD ports (Ldap, Kerbeos, RPC,
etc) on the firewall to all the member servers.
Member servers have to authenticate THEMSELVES when
they boot anyway.
So you will need them to be able to talk to AT LEAST
a DC of their own domain.
I just want to have the
ports open for the Domain controllers. Plus authenication will be much
quicker locally.
Clients (and member servers or computers) will normally
authenticate to a local DC anyway, but both users AND
computers (including member servers) need to authenticate.
I got 2 different Sites and Subnets setup. This should
work right?
The Sites will help control replication (efficiently across
the WAN) and the authentication will NORMALLY happen
in the same SITE IF there is a DC present in that site.
If not, I totally misplanned. Thanks for any help in this
matter.
--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]
.
- Prev by Date: Re: LDP.exe version to manage SACLs and DACLs
- Next by Date: Re: change of Account policy in Domain security policy
- Previous by thread: Re: LDP.exe version to manage SACLs and DACLs
- Next by thread: Re: replmon **DELETED SERVER #1
- Index(es):
Relevant Pages
|
