Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a one-way domain trust setup and it's working if I want to deal with users on a per-user basis from the trusted domain. Let's say we have 'Parent.Domain.com' and 'Child.Domain.com' where Child trusts Parent but Parent does not trust Child - aside from this trust, the two domains are 100% unrelated. For all servers within Child, I can now specify permissions for users in Parent, so that tells me that the trust is working.

Now I'd like to take it to the next level and start setting up permissions domain-wide within Child for my Parent users and groups, but this is where I'm failing. The first thing I wanted to do was have all Domain Admins within Parent also be in the Domain Admins group in Child. However, when I go to add this membership to the Child's Domain Admins group, I can't see anything from my Parent domain, groups nor users (I simply don't see Parent.Domain.com within the Locations tree).

My research shows everybody mentioning Group Scope as being important here, so I started looking into this. After research and trial/error, I am able to create a new group (domain local) called Parent Domain Admins and add the Domain Admins group from the Parent domain into it. However, I still cannot add this group into the Domain Admins group in Child.

I'm to the point where I don't know what else to try and Google is failing me. How can I accomplish this sort of thing?

share|improve this question
    
Any chance you can merge these two domains into a single forest? It would likely make your life a WHOLE lot easier. –  Coding Gorilla Sep 22 '10 at 19:18
    
Maybe. To be honest, I really don't know. I'm not much of an AD admin - I'm more of a dev. However, it is important that users in the Child domain can never have access to a single thing in the Parent domain. If I add both domains to a forest, can I still keep this one-way trust in place? –  Jaxidian Sep 22 '10 at 19:41
1  
If you put them in one forest, and make the child an actual child of the parent domain, then there is an implicit down level trust. So you would have something like: parent.domain, and child.parent.domain. This would most likely involve completely reworking your AD structure, so I'm not sure that's feasible for you or not. Here's some good reading for you tho: technet.microsoft.com/en-us/library/cc750087.aspx –  Coding Gorilla Sep 22 '10 at 20:08
    
Doing this - would it be possible to disconnect the two domains at some point in the future? We have the requirement that we need to support the ability for our Child.Domain.com domain to function in 100% isolation from the other domain. Obviously this would cause the Parent accounts to no longer access it, but that's fine. We just need everything that exists completely within the Child domain to continue operating if we pull all servers and put them into a new network. –  Jaxidian Sep 22 '10 at 20:29
1  
I don't think so, but keep in mind that just because there is a trust relationship between the two domains doesn't mean anyone from parent has access to anything on child (or vice-versa). It just means that access CAN be granted (or denied for that matter). –  Coding Gorilla Sep 22 '10 at 20:42
show 1 more comment

1 Answer

up vote 1 down vote accepted

My solution to this problem was to create a domain local group (like you had done), add the desired users from the parent domain to the child domain local group, and then use group policy to add that group to the local administrators group of all computers in the child domain.

share|improve this answer
    
I like this idea although I'm not crazy about having to rely on group policies to do this. Perhaps I should be more open to it. I just hate dealing with group policies at this point since I don't really know what I'm doing with them but I do know enough to know how much trouble I can get into. I'll consider this. Thanks! –  Jaxidian Sep 23 '10 at 16:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.