Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Right now, I have three forests I'm trying to create trusts between.

Let's call them hopelessn00b.local, hopelessn00b.com and internal.hopelessn00b.com.

I got trusts configured between hopelessn00b.local and hopelessn00b.com, as well as between hopelessn00b.local and internal.hopelessn00b.com, but when I went to set up the trust between hopelessn00b.com and internal.hopelessn00b.com, it bombed out, because hopelessn00b.com cannot contact internal.hopelessn00b.com.

So, I checked DNS, and sure enough, there's no forwarders or stub zones or anything that might tell hopelessn00b.com how to get to internal.hopelessn00b.com. I checked my hopelessn00b.local forest, and it was using a conditional forwarder to reach both the other domains, so I tried to set up a conditional forwarder on hopelessn00b.com with the IPs of my internal.hopelessn00b.com domain controllers. That fails with a "zone configuration error," after telling me that my internal.hopelessn00b.com domain controllers are not authoritative for the internal.hopelessn00b.com domain (they are). I assume that's because internal.hopelessn00b.com is a DNS sub-domain of hopelessn00b.com, even though they're completely different and unrelated AD forests.

Functional levels involved are 2008 R2 and 2012, if it makes a difference (but I don't think it does), and I'd very much like to get these trusts set up so that I can migrate everything off these improperly named forests and then blow them away, so only internal.hopelessn00b.com will remain.

Accordingly, my questions are:

  1. Is a conditional forwarder the thing I want here, or should I be using something else? (Stub zone, maybe?)
  2. How do I force (or finesse) hopelessn00b.com into taking my word for it that the DCs for internal.hopelessn00b.com are actually authoritative for internal.hopelessn00b.com?
share|improve this question
1  
Delegate, you must... support.microsoft.com/kb/255248 –  Ryan Ries Feb 3 at 14:15
    
@RyanRies But there are no child domains at play here, nor do I wish there to be. I don't want the best-practices-compliant internal.hopelessn00b.com AD forest to become dependent on the soon-to-be-obliterated hopelessn00b.com AD forest. Is a delegation still applicable in this case? –  HopelessN00b Feb 3 at 14:32
    
@HopelessN00b: Ryan is correct, you need to dns delegate. Even if there as you say is no AD child domain, there is in dns by way of namespace. On the bright side, when you have obliterated to your hearts content you could simply remove the delegation and refer/forward dns clients directly to the (not-)child domain. Sorry, can't work out how to phrase that last bit, I hope you understand my intention :-) –  ErikE Feb 3 at 15:02
    
@RyanRies Yeah, that did it. If you want to put that into an answer, you can get some +rep for it. –  HopelessN00b Feb 3 at 15:37

1 Answer 1

up vote 4 down vote accepted

Since the two domains, even though they are in unrelated AD forests, are part of the same DNS namespace, you must use DNS delegation.

share|improve this answer
    
Replaced your link with an article on creating a DNS delegation zone for Server 2008/2008 R2 that didn't include all the child domain hooey that's not applicable here. Feel free to rollback the revision if you object. –  HopelessN00b Feb 4 at 1:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.