I need some help with exchange linked mailboxes with active directory trusts.

I have an AD-trust between two domains (Type External, bidirectional, non-transitive, selective authentication). Domain A is hosting the Exchange server (2016), Domain B has the user accounts. When I try to add a linked mailbox on the Exchange in Domain A, the wizard requires to enter admin credentials from Domain B. I read this Microsoft KB and this should not be happening: https://docs.microsoft.com/en-us/exchange/recipients/linked-mailboxes?view=exchserver-2019#use-the-eac-to-create-a-linked-mailbox

There it says:

You won't be prompted for administrator credentials if you've created a two-way trust or have created another one-way outgoing trust where the account forest trusts the Exchange forest.

But when I'm trying to add a new mailbox, I have to enter admin credentials from Domain B: enter image description here

What I don't understand is: When I enter a domain user from Domain B (a normal user, without admin rights!), the wizard accepts this and I can create the mailbox. I tested the login in OWA with the credentials from Domain B and it worked.

Can someone explain me, why the wizard want me to enter admin credentials from Domain B?

What if I don't enter an admin user and just use a normal user without admin rights - am I missing something? Is something not going to work?

What do I have to configure, so that I don't have to enter any credentials, like it's described in the Microsoft KB?

Thank you very much.

  • My guess is that the selective authentication setting in the AD trust is the culprit here – Gert Jan Kraaijeveld Nov 16 '20 at 12:30
  • I tested it without selective authentication, same results. I changed it on the fly, I don't know if that was sufficient. But I need the selective authentication method anyway. If that would be the reason, I need to know which permissions I have to set. – Niko21 Nov 16 '20 at 12:49
  • Does your Domain-A Exchange admin account have any permission in Domain-B? – Gert Jan Kraaijeveld Nov 16 '20 at 12:58
  • No. Which permission is needed there? – Niko21 Nov 16 '20 at 15:37
  • I am not sure. First try domain admins. If that works you know you're on the right track. Then something less privileged. I think it is enough to have read permissions in AD. I am not able to test this myself at this moment. – Gert Jan Kraaijeveld Nov 16 '20 at 16:13

Could you validate the forest trust in the Active Directory Domains and Trusts? If the validation failed, I guess that the trust has not been built completedly. enter image description here

Please refer to the following guide and see if there are some steps lost in the trust process: How to create a cross-forest trust in Active Directory

  • Trust is working without any problems and is used in production. Only the exchange part is new. I checked the validation, no problems there. – Niko21 Nov 17 '20 at 18:20
  • If your organization has configured a one-way outgoing trust where the Exchange forest trusts the account forest, you're prompted for administrator credentials in the account forest(docs.microsoft.com/en-us/exchange/recipients/…). Please check if your two forests are using this method to build trust. – Ivan_Wang Nov 19 '20 at 10:01
  • Both forests are configured as two-way-trust. – Niko21 Nov 20 '20 at 11:07
  • Based on my test, as Gert Jan Kraaijeveld said, the issue seems be caused by the authentication of AD trust. My test snapshots which post in my new answer are for your reference. – Ivan_Wang Nov 24 '20 at 5:25

Forest-wide authentication:

enter image description here

enter image description here

Selective authentication:

enter image description here

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.