0

There are two domains: "dom1" and "dom2".

  • "dom1" is the trusting domain.
  • "dom2" is the trusted domain.

I.e. there is a one way trust where domain "dom1" trusts domain "dom2".

Servers joined to domain "dom2" and logged in with an account in the "dom2" domain, can access file shares on servers joined to the "dom1" domain. No issue here.

However, on a server joined to the "dom1" domain (server name: myserver.dom1.com) and logged in with an account in the "dom1" domain (logged into the server using dom1\myuserondom1, it is not possible to run an application using "Run as different user" and using a user account on the "dom2" domain (example: using an account such as dom2\myuserondom2)

When attempting to do this, the error below is shown:

There are currently no logon servers available to service the logon request

Error message - There are currently no logon servers available to service the logon request

On myserver.dom1.com, if I do nslookup dom2.com it returns the name servers correctly.

On myserver.dom1.com, we are not able to add dom2\myuserondom2 to any local groups.

5
  • From myserver.dom1.com run: nltest /dsgetdc:dom2.com
    – Greg Askew
    Sep 29 '15 at 20:49
  • @GregAskew This returns the following message: Getting DC name failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN. The domain name was entered correctly and I did use the FQDN to test this as well.
    – slayernoah
    Sep 29 '15 at 20:53
  • Run PortQueryUI from myserver.dom1.com against dom2.com.
    – Greg Askew
    Sep 29 '15 at 22:18
  • @GregAskew Should I do Service to Query = Domains and Trusts?
    – slayernoah
    Sep 29 '15 at 22:28
  • Yes, domains and trusts.
    – Greg Askew
    Sep 29 '15 at 23:19
2

Unless I'm thinking about this wrong I don't think this particular scenario should work to begin with. DOM1 trusts DOM2 but DOM2 doesn't trust DOM1. You're trying to use runas as a DOM2 user from a DOM1 computer. That should mean that in order to authenticate the DOM2 user the authentication request has to flow from DOM1 to DOM2, and since DOM2 doesn't trust DOM1 it fails. No?

A DOM2 user can't be authenticated by a DOM1 Domain Controller. A DOM2 user has to be authenticated by a DOM2 Domain Controller. The authentications flow tells me that this shouldn't work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.