0

We want user from the newly acquired company (domain b.com) to be able to authenticate to our helpdesk system in domain a.com via Active Directory. We do not have a point-to-point VPN to the new location and we are not planning to have one. Both company use static IPs for Internet access.

In both domains, the DNS server is a Domain Controller. Any pointer on what port(s) I need to open/forward so that I can create a trust between the two domain so that new users can authenticate to our helpdesk system?

2 Answers 2

10

It is relatively complex and is outlined in this excellent TechNet article.

Honestly, doing this without a site-to-site VPN is a BAD idea for a lot of reasons. I'd strongly reconsider that stance. If you can't afford proper hardware VPN endpoints, you could always use something like OpenVPN at each end. It even comes in a virtual appliance for super-easy delivery.

3
  • 3
    agreed...use a VPN between the two domains/locations. You'll need it regardless..there's no point in opening up ports to establish a trust if the clients can't access all the resources they need.
    – TheCleaner
    May 8, 2012 at 15:17
  • Thanks for all the reply, we mostly wanted them to be able to access our helpdesk system that is web-base so we would have just opened a port and pointed them to that in their web browser but since most of you seem to agree this is a bad way of doing it I will look at having a site to site vpn. I will see if I can find these virtual appliance for super-easy delivery mentioned by MDMarra above.
    – Cividan
    May 8, 2012 at 16:02
  • 1
    It's much more than just "opening a port".
    – MDMarra
    May 8, 2012 at 19:21
1

This is MS's list of ports required by feature.

As ErikA correctly points out this should really be over a VPN, I'd just assumed one was already in place sorry.

3
  • Linking to that without mentioning the necessity of VPN is nearly downvote-worthy. :)
    – EEAA
    May 8, 2012 at 15:42
  • You can do it all over SSL though... but you're right, I'll add.
    – Chopper3
    May 8, 2012 at 15:50
  • True. It just seems dirty to do it without VPN, SSL or not.
    – EEAA
    May 8, 2012 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .