We want user from the newly acquired company (domain b.com) to be able to authenticate to our helpdesk system in domain a.com via Active Directory. We do not have a point-to-point VPN to the new location and we are not planning to have one. Both company use static IPs for Internet access.

In both domains, the DNS server is a Domain Controller. Any pointer on what port(s) I need to open/forward so that I can create a trust between the two domain so that new users can authenticate to our helpdesk system?


It is relatively complex and is outlined in this excellent TechNet article.

Honestly, doing this without a site-to-site VPN is a BAD idea for a lot of reasons. I'd strongly reconsider that stance. If you can't afford proper hardware VPN endpoints, you could always use something like OpenVPN at each end. It even comes in a virtual appliance for super-easy delivery.

  • 3
    agreed...use a VPN between the two domains/locations. You'll need it regardless..there's no point in opening up ports to establish a trust if the clients can't access all the resources they need. – TheCleaner May 8 '12 at 15:17
  • Thanks for all the reply, we mostly wanted them to be able to access our helpdesk system that is web-base so we would have just opened a port and pointed them to that in their web browser but since most of you seem to agree this is a bad way of doing it I will look at having a site to site vpn. I will see if I can find these virtual appliance for super-easy delivery mentioned by MDMarra above. – Cividan May 8 '12 at 16:02
  • 1
    It's much more than just "opening a port". – MDMarra May 8 '12 at 19:21

This is MS's list of ports required by feature.

As ErikA correctly points out this should really be over a VPN, I'd just assumed one was already in place sorry.

  • Linking to that without mentioning the necessity of VPN is nearly downvote-worthy. :) – EEAA May 8 '12 at 15:42
  • You can do it all over SSL though... but you're right, I'll add. – Chopper3 May 8 '12 at 15:50
  • True. It just seems dirty to do it without VPN, SSL or not. – EEAA May 8 '12 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.