0

I have two domains (same LAN subnet) lab1.tld & lab2.tld I configured a one-way external trust (with selective authentication) for those domains plus a secondary DNS zone pointing to the "opposite" domain in each of them.

1 ) dc1.lab1.tld

  • IP: 10.0.0.1
  • Incoming Trust: lab2.tld
  • Trust Type: External trust
  • Primary DNS zone: lab1.tld
  • Secondary zone: lab2.tld
  • DNS zone transfert allowed to dc1.lab2.local (10.0.0.2)

2 ) dc1.lab2.tld

  • IP: 10.0.0.2
  • Outgoing Trust: lab1.tld
  • Trust Type: External trust
  • Primary DNS zone: lab2.tld
  • Secondary zone: lab1.tld
  • DNS zone transfert allowed to dc1.lab1.local (10.0.0.1)

3 ) server.lab2.tld

  • IP: 10.0.0.3
  • Share: D:\myshare

Currently I can affect permissions on shared directory in lab2.tld domain to users that belong to lab1.tld domain.

I can resolve lab1.tld FQDNs from lab2.tld & lab2.tld FQDNs from lab1.tld

Unfortunetly I can't access my shared folder sitting in lab2.tld domain from lab1.tld domain. Note that no matter if I use an \server.lab2.local\myshare or \10.0.0.3\myshare from lab2.tld domain, non of them work properly.

How to configure domain trust and DNS to share content with an external domain, what I am missing with the current configuration?

  • Unfortunetly I can't access my shared folder sitting in lab2.tld domain from lab1.tld domain. Note that no matter if I use an \server.lab2.local\myshare or \10.0.0.3\myshare from lab2.tld domain, non of them work properly. - What does that mean exactly? What happens? – joeqwerty Jan 11 at 15:27
  • From "server.lab1.tld" I'm trying to browse fileshare on "server.lab2.tld" with explorer using either "\\server.lab2.local\myshare" OR "\\10.0.0.3l\myshare". There is an error message "Windows cannot access \\server.lab2.local\myshare" (...) Error code: 0x80004005 Unspecified error" – donmelchior Jan 11 at 15:50
  • Selective Authentication requires granting the "Allowed To Authenticate" permission on the target computer objects. – Greg Askew Jan 11 at 16:01
  • @GregAskew, I granted "Allowed To Authenticate" permission to my test user (lab1.tld\testuser) on: server.lab2.tld and dc1.lab2.tld, plus to dc1.lab1.tld (lab1.tld domain controller) on dc1.lab2.tld. I can't mount access file share on "server.lab2.tld" from trusted domain "lab1.tld". What Am I missing here? – donmelchior Jan 14 at 10:08
  • I can see multiple entries for failed sessions on server.lab2.local security event log: "Event: 4625. Security ID: NULL SID (...) Authentication package: NTLM (...) – donmelchior Jan 14 at 11:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.