We exist in a big enterprise (with an active directory where we cant get administrator privileges obviously) and would like to setup a local Active Directory for our development department.

This question is part of a case I can present to the enterprise AD people, defining exactly what we need from them. I do not propose to do this task without them doing some action on their part.

We would like to be able to use our enterprise AD users in our local AD.

In this local AD we would like to put our development servers, some of them will be provisioned from golden images and thrown away on hourly basis or faster.

Part of this exercise is that we want to login to servers existing in our local AD with users existing in the enterprise AD. Using enterprise AD as authentication and our local AD as authorization.

Is this a child domain or an external domain with one-way trust?

Can anyone educate me a bit, maybe with some ideas on how to setup a lab in such a way that we can test against the enterprise AD without having admin privileges in it.

closed as off-topic by TessellatingHeckler, mdpc, Ward, Magellan, colealtdelete Nov 2 '15 at 0:31

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Ward, Magellan, colealtdelete
  • "Requests for product, service, or learning material recommendations are off-topic because they attract low quality, opinionated and spam answers, and the answers become obsolete quickly. Instead, describe the business problem you are working on, the research you have done, and the steps taken so far to solve it." – TessellatingHeckler, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You can neither create a child domain nor create a Domain/Forest trust without having access to the appropriate credentials in the enterprise AD domain. – joeqwerty Oct 26 '15 at 22:40
  • extended my question to point out that I intend to get the enterprise AD people involved at some point. – Casper Leon Nielsen Oct 26 '15 at 22:43
  • 1
    Yes it's possible with a trust, but can you push it entirely onto them to make a solution, through any appropriate management? Whatever you come up with, there's a chance they'll say "someone who's not familiar with AD has chosen a terrible solution, we're not happy to support it" and drag it out. For example, why can't you put your development servers in the enterprise active directory? Presumably you aren't developing AD related services, based on your question. – TessellatingHeckler Oct 26 '15 at 22:53
  • 1
    It is possible, you want to create a new domain within the forrest with a one way domain Trust (Your domain trusts the Enterprise but not the other way round). You will need their help as you will not have credentials. Afterwards you want Domain Administrator privileges in your domain. Your enterprise AD team are best placed to fill in the details. – Sam Oct 26 '15 at 22:53
  • 2
    What is the actual purpose here? – Mathias R. Jessen Oct 26 '15 at 22:55

I would go with a one-way forest trust. You may also be able to use an external trust, but some narrow edge cases just don't work correctly with an external trust but work ok with a forest trust. Depending on what you are doing, there may need to be some accommodation in the production forest to get name resolution working (stub zone/dns suffix search order).

A child domain is not a good choice due to test environments are usually a security risk, and a forest is the security boundary. (Child domain trusts are transitive). A one-way trust ensures no access from the test environment to the production forest.

  • Thank you for the reply. It asserts my assumptions. Will mark it as answer tomorrow if no more input are coming. – Casper Leon Nielsen Oct 27 '15 at 13:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.