Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am on my home network and connect to workplace via a VPN.

I have a DC on my home network (DC1 , domain = home). How can I setup a 1 way trust, so that I am able to run executables, such as SQL Management Studio using RunAs - then type in credentials for work domain?

First question is, will a 1 way trust solve this, and can I set this up without bothering a network admin at workplace (assuming I have a domain account with enough permissions on work domain)

If yes - any good step by step guide to setup 1 way trust? Server is Windows Server 2008 R2. As mentioned its DC running DNS Role too.

Thanks in advance

share|improve this question

closed as off topic by kce, mdpc, dunxd, Scott Pack, Bryan Mar 17 '13 at 12:50

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

For gods sake please do bother a network admin for this one. If anybody even tried this on my network without asking I'd have them sacked. – Ben Pilbrow Dec 6 '10 at 21:44
@Ben reread the question. I need to setup 1 way trust, my whole point is NOT to change any trust levels on the work domain, only my home domain. – MichaelOz Dec 6 '10 at 21:48
I did read the question. You don't make it clear if you have authority to do this (your point about asking a network admin makes me think you don't). Bottom line is if you don't have authority (in writing might be a good idea) to do this, DON'T. – Ben Pilbrow Dec 6 '10 at 21:54
@Ben it could be I'm using incorrect terminology which is confusing the issue. – MichaelOz Dec 6 '10 at 22:03
I apologise if my first comment came on a bit strong. I don't want to get you in trouble, and I also don't want to get your network admin in trouble for allowing you to do this without consent. Like I said, I'd have anybody trying to do this without permission sacked, and I would expect the same for me if it happened to my network. – Ben Pilbrow Dec 6 '10 at 22:06

Ok, so this is similar to what I've been trying to achieve (as per my comment on your question above) for different reasons. From doing some research on previous ServerFault questions, I've found that the /netonly switch for RunAs makes this work.

I've tested this myself. Created a batch file containing:

RunAs /netonly /user:Domain\Username mmc.exe

Ran it and added the ADUC snappin, connected it to the DC on the remote domain and it works perfectly. What /netonly does is to not authenticate using the supplied credentials when the target is launched, but when authenticating remotely. This means the account you supply in the runas command doesn't need to be validated and therefore can be on a remote domain.

No trust relationship required, just a connection to the remote domain.

share|improve this answer

You don't need a trust. Go into your DNS setting on your DC (it is your dns server right?) and create a conditional forwarder. You can specify auth infor DOMAIN\user etc after you do this.

Now ... you HAVE cleared this with your admin right? And it's not against your companies AUP to use home machines to connect to the work network right?

share|improve this answer
Correct, no restrictions there policy wise. And yes, its basically just one server which is DC, that I'm using off site for MOSS dev. – MichaelOz Dec 6 '10 at 21:54
ok, I setup a forwarder to the best of my knowledge, located the work DNS server, but this hasn't solve my issue. When I try RUN AS - select an app, I get this error - The security database on the server does not have a computer account for this workstation trust relationship. – MichaelOz Dec 6 '10 at 22:07
@MichaelOz what happens when you run nslookup <work_domain.whatever>? – Zypher Dec 6 '10 at 22:16
for example <work_domain.hello> - gives me the address of work primary dns, then non auth lookup: <work_domain>.hello.<mydomain> and an address starting with 66. – MichaelOz Dec 6 '10 at 22:23
can you do runas /user:DOMAIN\user cmd ? – Zypher Dec 6 '10 at 22:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.