Re: Forest to Child -- Permissions

"Herb Martin" wrote:

"santa''''s helper" <santashelper@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:CA980F9B-FA7D-4F5E-A7EE-8816E6EC175D@xxxxxxxxxxxxxxxx
Here is my environment:
There are 3 domains -- root.com, child.root.com, newtree.com - ea with 3
DCs

Concerning DNS:
Root domain
has a delegated sub domain pointing to the child.root domain

Technically a "delegated zone" and "subdomain" are two different
things -- the latter being merely an additional name tag in the parent
zone -- but I assume you mean the parent DELEGATED to the child
zone servers (if not you need to fix this by removing the true
"subdomain" and actually delegating or using another method.)

has a stub domain pointing to the newtree domain
Root.child domain
has conditional forwarding, no recursion, back to the root
has a stub pointing to the newtree domain

You could use Conditional Forwarding for each stub, but there
is nothing wrong with the current method. You could also use
Forest-Wide AD Integration for EVERY ZONE instead of these
conditional forwarders, stubs, and delegation even.

Just choices however so nothing wrong with what you have.

NewTree domain
has conditional forwarding, no recursion, back to the root
has a stub pointing to the child.root domain

Perfectly fine again, but technically the stub is technically unnecessary
since the entire Parent-Child tree can be found from the parent.

DCDiag --- passes all test for all DCs

Good.

I have a root, domain admin accout.
I was able to create and can login to all DCs with my root account as an
admin

So generally authentication and trusts are working as expected.

Any comments (or a better way) on the above are welcome; however, here is
my
issue at the moment:
I can create member servers at the child and new tree levels, but
after the reboot, when I login with my root account to the member
servers
I don't have administrator privelages -- only user privelages.
Why? What am I missing?

I don't see it -- unless those member servers cannot authenticate
properly OR your client DNS settings (even on servers) cannot
find everything. You've covered this from the DNS SERVER point
of view, but perhaps the client settings are wrong...

All internal "client DNS" settings must reference ONLY "internal"
DNS servers that can resolve all (both internal and external) names
the clients will need.

When you said "root Domain Admin" did you in fact mean an
ENTERPRISE ADMIN or "just" a domain admin?


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Thanks in advance for your help. S



Hey Herb --- thanks for taking care of me ... Again!! :)

I don't see it -- unless those member servers cannot authenticate
properly OR your client DNS settings (even on servers) cannot
find everything. You've covered this from the DNS SERVER point
of view, but perhaps the client settings are wrong...

All internal "client DNS" settings must reference ONLY "internal"
DNS servers that can resolve all (both internal and external) names
the clients will need.

When you said "root Domain Admin" did you in fact mean an
ENTERPRISE ADMIN or "just" a domain admin?

Yeah -- I don't get it either.
My account, at the root level, is a member of:
Administrators
Domain Admins
Domain Users
Enterprise Admins
Group Policy Creator
Schema Admins
I just did a copy from the default 'Administrators' group once I created the
first DC in the root.
What I don't understand is that my account works perfectly with all 9 of the
DCs. No issues.
However, the member servers (in both child and newtree domains) only
authenticate me as a regular user. They have their primary and secondary dns
pointers going to their DCs in their (child/newtree) domain, which should (as
shown below) then point up to the root.
I re-ran DCDIAG on all 9 DCs --- and everything passes without exception.
Ideas?

Thanks Again, S

.

Relevant Pages

  • Re: Forest to Child -- Permissions
    ... first DC in the root. ... the member servers only ... DCDiag pretty much confirms authentication AND that DNS is right. ... never happen unless some admin has been mucking about. ...
    (microsoft.public.windows.server.dns)
  • Re: MS Update Breaks External DNS again
    ... name checking: Multibyte Load zone data on startup: From Active ... Yes I have to force root hint updates on both servers manuall (i use ... This is what is in both of my DNS servers cache.dns files. ...
    (microsoft.public.windows.server.dns)
  • Re: Problems with named default configuration in 6-STABLE
    ... transfer the zone, the hints mechanism is still in the comments. ... with overall root traffic for the root zone, ... slaving the root zone will make you still being able to resolve DNS ... servers worldwide being unreachable. ...
    (freebsd-stable)
  • Re: W2k3 DNS initial design
    ... I would configure Forwarders at the root DNS servers, ... Forwarders do not respond anyway, ...
    (microsoft.public.windows.server.dns)
  • Re: Replication Monitor error
    ... I am logged as domain admin for the root domain ... The subdomain DC's forward to the root DC's ... then this will probably be a DNS error. ... >> the new server from replication monitor on any other DC in the ...
    (microsoft.public.windows.server.active_directory)