Client has two domains residing on the same subnet/physical network. Essentially there's just a POP3 mail server (OLDSERVER) and one of the old DCs (OLDDC) on life support to keep OLDSERVER happy. There is no trust established between the two forests; they're not aware of each other's existence.

I want to temporarily mount a mapped drive via net use to OLDSERVER from NEWSERVER so I can run a file sync job over the course of a few nights to get all the mail data off of the old server, but I'm getting trust relationship errors, regardless of how the domain is specified with the /USER: option.

I'm reasonably certain that if I changed the DNS server bindings on NEWSERVER or maybe added a forwarder for the old FQDN to the OLDDC, I could possibly get this to work, but I'd rather find a command line method of specifying which DC to query/authenticate against so that I can map a drive temporarily; thinking out loud, a hostfile entry for the required DNS entries for the old domain, resolving to the OLDDC required may be a potential solution too.

Another alternative may be just to install a temporary FTP server and avoid SMB/Windows-based authentication altogether (or just use a USB drive), but I'm more curious than anything right now to know if this is possible.

EDIT: HOSTS file method will likely not work as SRV records are not supported. For non-SRV aware clients, you can specify a particular A record, but I would suspect that non-SRV aware clients would not include Windows Server 2008 R2; from an MSDN blog article on required DNS records for Active Directory:

GC IP Address - gc._msdcs.<DnsForestName>

Allows a non-SRV-aware client to locate any Global Catalog server in the forest by looking up >an A record. A name in this form is returned to the LDAP client through an LDAP referral. A >non-SRV-aware client looks up this name; an SRV-aware client looks up the appropriate SRV >resource record.

Net Logon also registers a DNS CNAME (alias) record for use by Active Directory replication >The Locator does not use this record.

  • Why not authenticate with local user credentials to OLDSERVER and bypass the domain altogether? – joeqwerty Feb 27 '15 at 16:37
  • @joeqwerty Yeah, that's what I ended up doing. – gravyface Mar 1 '15 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.