Re: To trust or not to trust???

Hi Austin,

Firstly many thanks for the reply.

There is a 'human trust' issue but I think that that is normal in any
merger. Two IS managers , each trying to sus the other out! However, getting
beyond that, as we are currently two distinct entites with different methods
of working and as of yet we do not know what the ultimate network design
should be then do you think setting AD trusts a 'sfaer' option whilst
business parcatices align.

To complicate matters a little both sites will be merging into one.
Ultimately we will be moving to their location and with their planned
infrastructure changes I don't want to place all our eggs in the one baskett
as we do not know what interruptions to service might be.

Your thoughts are greatly appreciated.


"Austin Osuide" wrote:

Hi Jmos,
The underlying issue is one of trust. Not AD trusts mind :-)
Do you trust the way the partner forest is managed? Looks like, from what
I'm reading, they don't exactly trust you and want to delegate an OU in
their forest for you to manage your resources in.

I would have thought, if you had WS03 domains, that a forest trust would
have been easier to setup/manage than a migration of your resources into an
OU in their forest.
Also, if you do do the migration to an OU in the partner forest, why should
the migrated Admins be domain Admins? No need really. They can have
delegated responsibilities at the OU level.

There are no hard and fast technical reasons that determine which way you
should go wrt their forest or yours.
The political decision IMHO should be sorted out then the technical solution
will follow.

Regards,

Austin


"jmos" <jmos@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:EE504811-A103-43AA-8823-0D617B20D982@xxxxxxxxxxxxxxxx
We currently have two companies which need to merge but a difference of
opinion and I could do with another view.

As a standard practice I want to setup a trust between both forests so
that
resources can be easily accessed from each other domain without too much
issue. This buys the IT depts from both sites time to align AD's over a 9
month period.

However, their IT dept don't want to do that as 'it's too much work' and
'more complicated'. Thus their suggestion is that they send us a DC
configured in their domain and we migrate our AD into a subset OU of
theirs.

Obviously block inheritance would be a must and both sets of Admins would
have to have access at Domain Level.

I'm not convinvced and want a more stable and stage approach to the merger
of the two entities.

Can anyone offer andy help or advice on this issue?

Many Thanks

JMOS

.

Relevant Pages

  • Re: creating one way trust
    ... of different forest. ... It sounds for me that you do not need/have a trust, ... Once everything is replicated from the win2k svr. ... Let me try to understan a little more about youre network. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Huge AD deployment
    ... That was the case in Windows 2000, but in Windows Server 2003 forest trusts ... note though is that a forest trust is only transitive for domains within the ... >> company.com in that data center and have every country trust company.com ... instead of going over the internet. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain Functional Levels and Trusts
    ... other type of trust, i.e., Forest Trust ... A Forest Trust and an External trust are TWO DISTINCT types ... FORESTS to be in Win2003 Forest Functional Level. ... External trusts are possible in any MODE, ...
    (microsoft.public.windows.server.active_directory)
  • RE: Two way forest trust fails only in one direction
    ... After deep research of the SMB signing, we saw that both servers need Reg Key: ... needed to match on both servers on both sides of the trust. ... B's Forest, but Company B can not access Company As forest at all. ... running DNS and WINS under Windows Active Directory. ...
    (microsoft.public.windows.server.active_directory)
  • Re: admt and virtual pc
    ... are both 2003 and the same forest there should be a default implicit trust. ... ADMT but you don't actually say that and more importantly ... ADMT requires the Source Domain ...
    (microsoft.public.windows.server.active_directory)
Loading