So, I have two forests, let's call them alpha.example.com and bravo.example.com. The NETBIOS names of the domains are ALPHA and BRAVO, respectively. That would seem to imply that there is no problem with the domain naming, they have two different names, both DNS-wise and NETBIOS-wise.
I have the following servers as domain controllers:
When I try to establish a forest trust between ALPHA and BRAVO like this, I get "No Logon servers available to service the logon request" when it comes to actually verify the trust. I've found some forum threads online as well as heard some anecdotal evidence that there are issues when connecting two domains together where there are the same names for the domain controllers in both domains. This doesn't seem to make sense to me, and it sounds like it's a bug in Microsoft tools.
I didn't think this should be an issue, since dc01.alpha.example.com and dc01.bravo.example.com are obviously two different machines, but Windows doesn't seem to agree with me.
Am I missing some piece of information that would enable me to get this setup to work? Renaming the domain controllers is a bad answer for us unfortunately, because the end game is connecting together a lot of forests that all have domain controllers named the same. That would mean renaming a bunch of DC:s.
For the record, renaming one of the domain controllers does allow me to establish a trust, but I really don't want to have to do that in the real world if I can help it.
All machines in the lab are running Windows Server 2012 R2 up to date on patches, but with no special hotfixes installed.
DNS is setup in the following way: in the ALPHA domain, a stub zone is added for bravo.example.com, pointing at dc01.bravo.example.com's IP address. In turn, dc01.bravo.example.com uses dc01.alpha.example.com and dc01.bravo.example.com as upstream DNS. It's a bit of a hacky setup (because it's a lab...), but the result is correctly workign DNS resolution in both ways. dc01.bravo.example.com can resolve names in bravo.example.com (because it's authoritative) and alpha.exaple.com names are correctly resolved because upstream DNS is authoritative for it. Resolvers in alpha can resolve bravo's names correctly because of the stub zone (which is added to AD so that both DNS servers get it.)
I have additionally tried:
- Changing from a stub zone to a conditional forwarder
- Running a forest trust rather than an external trust
No change in symptoms.