Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a two way trust in place between two Windows forests.

We get "errors" constantly on our domain controllers in both AD forests regarding clients whose IP addresses don't conform to an AD site subnet.

The reason I think I understand. Client from FOREST-A travels to a location in FOREST-B and logs on with their FOREST-A account. The computer gets an IP address from a DHCP server in FOREST-B but the AD authentication occurs across the WAN back to a DC in FOREST-A. That DC then logs the error in the c:\windows\debug\netlogon.log file on the DC as it authenticates the client.

While it's probably safe to ignore the error...is there a way to actually remedy the issue?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Add the respective subnets in AD Sites and Services, and perhaps create a separate site you assign those subnets to. The site doesn't need its own DC.

share|improve this answer
    
I thought about that...but can I (or better still should I) add subnets for a remote forest into ADS&S? –  TheCleaner Sep 6 '12 at 19:22
    
You can add the subnets, or you can live with the warnings. Your choice. –  Ansgar Wiechers Sep 6 '12 at 19:24
    
Are you certain though that I can add subnets to ADS&S for a remote forest when no DC for that remote forest exists in that subnet without messing it up? Do you have a source for your answer? –  TheCleaner Sep 6 '12 at 19:32
    
Yes, I am certain. I have done this myself. I don't have a source other than personal experience. –  Ansgar Wiechers Sep 6 '12 at 19:48
    
If there's no DC in that site that the subnet is attached to in ADSS how does the client decide –  TheCleaner Sep 6 '12 at 19:49
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.