Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I am trying to design an environment that has one forest with an empty root, a user domain and multiple domains for different groups that have firewalls between the domains. I want to have a central user database but segmentation at the IP level for each group of folks. For the first group the forest would look like this

enter image description here

I will be adding other groups' domains after this first one is working.

Assume there is a firewall between each domain and they are segmented with a subnet for each group's domain.

Here is the initial firewall design

enter image description here

I am trying to allow a user on the Application server to enumerate the users and group objects in the users domain. Here is the problem. My users can log in no problem if I don't allow any connectivity between the app server and the User DCs but they cannot enumerate users and groups. Other the other hand If I allow TCP 389 (LDAP) and TCP 88 (Kerberos) I can enumerate the users and groups but interactive logins are really slow and the app server is looking for 135 (EPmapper) to be open during profile load. As a test I opened 135 and then the EPmapper passed a random high for the netlogon port which of course the app server then tries to hit.

So what do you think is best course of action? I cannot open all random highs, that is silly. I can make the netlogon port static on all my DCs and then open only that port. Any other ideas?

share|improve this question

marked as duplicate by Falcon Momot, Ward, EEAA, Bryan, rnxrx Jun 27 '13 at 15:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted

Here is what you need.

share|improve this answer
I think your post got lost somewhere – Tom Seibert Feb 10 '11 at 1:39
Sorry, not sure what you mean ... – Vick Vega Feb 10 '11 at 15:14
The link for the MS article was not there last night. The word need was just text. Now it is good. – Tom Seibert Feb 10 '11 at 18:39
So after reading that, the article looks like it is DC to DC based communication which is currently working fine. I am looking more for advice on the best course of action. How to do it is clear in the MS docs. I just have at least two choices and am looking for the pros and cons of each. My focus is on the app server that is not a DC. How should it communicate to the DC in the remote domain? – Tom Seibert Feb 10 '11 at 18:40
Is there a chance to configure VPN between locations? – Vick Vega Feb 10 '11 at 18:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.