RE: Trust Relationship Between 2 Domains

Hi Vincent

Thank you for your reply, but the problem is not with just one PC but
several, i.e. 500 workstations and 18 servers, how could I possibly reset the
computer accounts and rejoin the domain on Domain Controllers, Exchange
Servers, DNS Servers etc. Isn't there another way or at least a method in
which I can update all the PC's automatically, without having the need to
rejoin the PC's one by one.

Thank you

Barazi

"Vincent Xu [MSFT]" wrote:

Hi,

It appears to be the computer account corrupt. You can try to reset the
computer account.

To perform this procedure, you must be a member of the Account Operators
group, the Domain Admins group, or the Enterprise Admins group in Active
Directory, or you must have been delegated the appropriate authority. As a
security best practice, consider using Run as to perform this procedure. 1.
Click Start , point to Programs , point to Administrative Tools , and then
click Active Directory Users and Computers .
2. In the console tree, under the domain node, click Computers , or click
the folder in which the computer is located.
3. In the details pane, right-click the computer, and then click Reset
Account . NOTE : Resetting a computer account breaks that computer's
connection to the domain and requires it to rejoin the domain.
To reset a computer account using a command line, type the following at a
command prompt, and then press ENTER
dsmod computer ComputerDN -reset

320187 HOW TO: Manage Computer Accounts in Active Directory in Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;EN-US;320187


Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------
Thread-Topic: Trust Relationship Between 2 Domains
thread-index: AcZ0JBlvZegG2m8DRdyFQa81IRPgGA==
X-WBNR-Posting-Host: 217.158.191.82
From: =?Utf-8?B?QmFyYXppIEZ1ZW50ZQ==?= <Barazi
Fuente@xxxxxxxxxxxxxxxxxxxxxxxxx>
Subject: Trust Relationship Between 2 Domains
Date: Wed, 10 May 2006 04:23:02 -0700
Lines: 54
Message-ID: <D9CC0B92-3132-4637-8FAD-E22D30CA1E03@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
Newsgroups: microsoft.public.windows.server.migration
Path: TK2MSFTNGXA01.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windows.server.migration:23661
NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
X-Tomcat-NG: microsoft.public.windows.server.migration

Hello

BACKGROUND
We have 2 domains setup at the site. Domain A was upgraded from NT to AD
2003 and Domain B at the time remained as NT. A trust relationship was
setup
between the 2 domains for users to access resources from Domain A & B.
This
has been working very well.

Domain B was then migrated to AD 2003 also. The server was upgraded to be
part of the Forest of Domain A. In the Forest is Domain A & Domain B.
Seeing
Domain B was upgraded, the trust relationships were inherited as:

TRUST TYPE: Tree Root
TRANSITIVE: Yes
Incoming and Outgoing in Domain A and Domain B.

All the security and Share permissions were set in Domain A & B so users
from both domains have access.

PROBLEMS
The first problems I noticed was that the DNS servers in Domain A did not
contain all the server details of Domain B, however I could see all the
DNS
servers of Domain B in Domain B. I checked all the replication topology.
Everything is being replicated without any errors to all servers in the
Forest.

What I found strange was that users in Domain B could access resources in
Domain A without any problems, however users in Domain A could not access
any
resources in Domain B. A dialog box would always appear asking the user
to
put in a username and password. Even though the user puts in the Domain
Admin username and password of Domain B, the user still gets Access is
Denied. The user account works perfectly fine when logging onto any
servers
and workstations in Domain B.

Recently I found 1 user in Domain A who could access resources
successfully
to domains A & B. After being unsuccessful in finding any differences
with
his PC and problem PC's as the issue was with the computer not user
account.

TEMPRORARY SOLUTION
I decided to re-join a problem PC back into Domain A and this resolves
the
problem. The computer can successfully browse resources in both domains
regarding the correct security permissions have been set.

WHAT SHOULD I DO?
Unfortunately I cannot rejoin all the workstations from Domain A as the
problem is also with the servers, including DC's, DNS, WINS, EXCHANGE
etc...
There has got to be another way. Why do I have to rejoin the PC's for
them
to work. Is there another way I can achieve my goal. I'm sure all the
DNS
entries will appear once this is done. Can you please help?

Thank you

Barazi




.

Relevant Pages

  • RE: Trust Relationship Between 2 Domains
    ... It appears to be the computer account corrupt. ... group, the Domain Admins group, or the Enterprise Admins group in Active ... In the details pane, right-click the computer, and then click Reset ... The first problems I noticed was that the DNS servers in Domain A did not ...
    (microsoft.public.windows.server.migration)
  • Re: Mixed forest Authentication issue - Active Directory netbios name
    ... If after the role transfer did this start occuring, is there possibly a static entry in WINS for the old servers indicating they are the browse masters? ... I solved the immediate fileshare problem and it turned out to be something completely unrelated to WINS. ... The problem occurred because the server retained it's original computer name and the original entry was never deleted in the 2000 AD. AD saw the same computer account with a different SID, ...
    (microsoft.public.windows.server.active_directory)
  • Re: FSmigrate crashes, disables admin acct... reliable?
    ... I am running it on the servers. ... me the article/info you found about the eTrust conflict? ... The file server is in resource domain and the computer account is found ... >>>the crashes during MSMigrate left the system in this instable state. ...
    (microsoft.public.windows.server.migration)
  • Distribution Points
    ... I recently created about 7 distribution points on windows 2003 ... servers and i gave the SMS Server computer account local admin rights ...
    (microsoft.public.sms.admin)
  • RE: How to block GPO on Servers OU
    ... Unless you precreated the computer account in the new Servers OU this is to ... DDP GPO. ... Prev by Date: ...
    (microsoft.public.windows.server.active_directory)
Loading