5

I'm having trouble setting up the trust relationship between a Windows Server 2003 and a Windows Server 2008 AD.

Domain a is Windows Server 2003 Forest functional level.

Domain b is a Windows Server 2008 Forest functional level.

I can set up the incoming side of the trust relationship on domain "a" so that it trusts domain "b".

Try as I might on domain "b" I can't set up the outgoing side of the trust relationship to domain "a".

The GUI interface gives an unhelpful 'The request is not supported'.

I'm not sure netdom is being more or less helpful as it refers me to FilterSIDs

netdom trust /add b /uo:b\admin /po:* /d:a /ud:a\admin /pd:* /oneside:trusting
To improve the security of this external trust, security identifier (SID)
filtering is enabled, however, if users have been migrated to the trusted
domain and their SID histories have been preserved, you may choose to turn off this
feature.

For more information about SID filtering and how to turn it off, see the help
for netdom trust /FilterSids or see Help and Support.

The request is not supported.

The command failed to complete succesfully.

I say 'less helpful' because Windows Server 2008 doesn't support the /FilterSIDs option.

How can we force creation of this trust?

Edit: Just to clarify I've checked that the [Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options] "Network access: Allow anonymous SID/Name translation” is enabled on both sides of the trust as per http://social.technet.microsoft.com/Forums/en/winserverDS/thread/cc61fc25-3569-4413-bbfd-92390eb31118

1
  • Did you properly prepare DNS on each domain prior to attempting to create the trust? Aug 29, 2016 at 1:24

1 Answer 1

2

I can set up the incoming side of the trust relationship on domain "a" so that it trusts domain "b".

This is strange. Because if the trust is incoming on domain a it means a is the trusted domain. ie: b trusts a.

Try to set the outgoing part of the trust first.

Your command tries to create the outgoing (trusting) part of the trust on domain b only. I think you need to set a trust password in this case. See: http://technet.microsoft.com/de-de/library/cc835085(WS.10).aspx

TRUSTING: Specifies to create or remove the trust object on the trusting domain. This value is valid only if you specify the /add or /remove parameter. The /passwordt parameter is required when you use the /add or /remove parameter.

Why do you use /oneside? Why not let netdom create both sides of the trust at once?

And make sure you don't have DCs with same names in both domains or else verification of the trust will fail.

6
  • I did try and set both sides of the trust first, but then nothing was created at all.
    – nick3216
    Nov 30, 2010 at 9:34
  • I've checked the DCs and they have unique names. When I try to create this trust using the GUI it does indeed ask for a trust password. I didn't use one because the Help for netdom said it was used only on non-windows Kerberos realms, so not applicable when both sides of my trust are Windows forests. If I do add it to the netdom command line the relationship still fails to be created.
    – nick3216
    Nov 30, 2010 at 10:10
  • I don't understand your first comment. "set both sides of the trust first, but then nothing was created at all" <- what do you mean? Try to create it without /oneside:trusting. Let netdom create both sides at the same time. Or: did you try to create the outgoing side on domain b first? I think /ud:a\admin /pd:* together with /oneside:trusting makes non sense either because /oneside:trusting doesn't do anything in the trusted /d domain.
    – boston
    Nov 30, 2010 at 11:14
  • Originally on domain controller 'a' I tried to set up a trust relationship for both sides of the trust - technet.microsoft.com/en-us/library/cc776300%28WS.10%29.aspx. No trust relationships were created on either DC. I've just destroyed all the trusts and tried again using netdom from domain controller 'b'. <pre>netdom trust /add b /uo:b\admin /po:* /d:a /ud:a\admin /pd:*</pre> The trust relationship has been set up on 'a', but still there is no outgoing relationship on 'b'
    – nick3216
    Nov 30, 2010 at 13:14
  • And you don't get any error message using "netdom trust /add b /uo:b\admin /po:* /d:a /ud:a\admin /pd:*" or the gui? Try /verbose?
    – boston
    Nov 30, 2010 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .