Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 3 full trust domains (2 child and one root). I need to use LDAP to allow authntication for domain users. The trick is that I need the application to use an AD server for the child domain BUT proxy the LDAP query and authentication for the root domain. I see that it maty be possible with AD LDS and some trusts and synching, but it looks pretty hairy and overly complicated.

The short of it is:

  1. 3 domains (Parent, ChildA, ChildB)
  2. My 3rd party app will need to use ChildA domain servers to authenticate either: a. a user in the parent domain or b. a user in the ChildB domain
  3. I already have full trusts between all domains, and regular NTLM authentication works fine (unless you are trying to authenticate with LDAP)
share|improve this question
What about using Kerberos authentication ? – Aurélien Derouineau Dec 12 '10 at 21:31

Well, this link may explain it:

Basically, the connecting computer (workstation) needs to be able to see the AD DC server on all the domains it plans to connect to; but the connected computer (server) does not need to be able to see the other AD DC server for the computers which connect to it.

So in practice, it may require you to think of where users (or applications) are connecting from and make those domains on a "higher privilege" to see those DC servers.

However, if you use ONLY NTLM type authentication, then only the DCs need to see each other and authentication will work fine. Though to my knowledge, LDAP queries should suffice if it connects to a Global Catalog server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.