So, we have two forests (AWS and On-Prem). The DCs can talk to each other and the one-way trust works fine.

Here is the problem.

If I create a share on the DC1 (in AWS), I can grant access to the users from the other on-prem domain DC2. But, if I go to an app server APP1 which is a member of DC1, I can't list the users and grant access. The only difference is that DC1 can talk to the other DC on-prem, but APP1 can't talk to the DC2 on-prem.

My question is: does APP1 server require access to the on-prem DCs DC2.

Thank you


Yes. Or you can put a RODC for the On-Prem domain in AWS.


Yes, if you use the builtin Windows tools like Explorer or the NET SHARE command.

If you know the security identifier (SID) of the security principal to grant access to, you can grant access to the SID using SETACL.

Example granting change share permission:

SetACL.exe -on "YourShareName" -ot shr -actn ace -ace "n:S-1-5-21-1004326348-1532298959-727345543-260587;p:change"  

Example granting change folder permission:

SetACL.exe -on "D:\FolderName" -ot file -actn ace -ace "n:S-1-5-21-1004326348-1532298959-727345543-260587;p:change"

Thanks guys!

We can't use on-prem RODC (not approved) and while the setacl solution works, we went with creating a domain local group on DC1 and adding users from DC2. So, there is no need to open ports on APP1.

FYI, per our policy all traffic originating from on-prem to AWS is allowed, all traffic originating from AWS to on-prem is denied.

Because I tried to list users on APP1 (AWS) from a DC2 (on-prem), my LDAP query got blocked. But creating a local domain group on the DC1 (AWS) and adding DC2 (on-prem) users worked, so I just had to add this group to the share on APP1 (AWS).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.