0

I have two domains (same LAN subnet) lab1.tld & lab2.tld I configured a one-way external trust (with selective authentication) for those domains plus a secondary DNS zone pointing to the "opposite" domain in each of them.

1 ) dc1.lab1.tld

  • IP: 10.0.0.1
  • Incoming Trust: lab2.tld
  • Trust Type: External trust
  • Primary DNS zone: lab1.tld
  • Secondary zone: lab2.tld
  • DNS zone transfert allowed to dc1.lab2.local (10.0.0.2)

2 ) dc1.lab2.tld

  • IP: 10.0.0.2
  • Outgoing Trust: lab1.tld
  • Trust Type: External trust
  • Primary DNS zone: lab2.tld
  • Secondary zone: lab1.tld
  • DNS zone transfert allowed to dc1.lab1.local (10.0.0.1)

3 ) server.lab2.tld

  • IP: 10.0.0.3
  • Share: D:\myshare

Currently I can affect permissions on shared directory in lab2.tld domain to users that belong to lab1.tld domain.

I can resolve lab1.tld FQDNs from lab2.tld & lab2.tld FQDNs from lab1.tld

Unfortunetly I can't access my shared folder sitting in lab2.tld domain from lab1.tld domain. Note that no matter if I use an \server.lab2.local\myshare or \10.0.0.3\myshare from lab2.tld domain, non of them work properly.

How to configure domain trust and DNS to share content with an external domain, what I am missing with the current configuration?

  • Unfortunetly I can't access my shared folder sitting in lab2.tld domain from lab1.tld domain. Note that no matter if I use an \server.lab2.local\myshare or \10.0.0.3\myshare from lab2.tld domain, non of them work properly. - What does that mean exactly? What happens? – joeqwerty Jan 11 at 15:27
  • From "server.lab1.tld" I'm trying to browse fileshare on "server.lab2.tld" with explorer using either "\\server.lab2.local\myshare" OR "\\10.0.0.3l\myshare". There is an error message "Windows cannot access \\server.lab2.local\myshare" (...) Error code: 0x80004005 Unspecified error" – donmelchior Jan 11 at 15:50
  • Selective Authentication requires granting the "Allowed To Authenticate" permission on the target computer objects. – Greg Askew Jan 11 at 16:01
  • @GregAskew, I granted "Allowed To Authenticate" permission to my test user (lab1.tld\testuser) on: server.lab2.tld and dc1.lab2.tld, plus to dc1.lab1.tld (lab1.tld domain controller) on dc1.lab2.tld. I can't mount access file share on "server.lab2.tld" from trusted domain "lab1.tld". What Am I missing here? – donmelchior Jan 14 at 10:08
  • I can see multiple entries for failed sessions on server.lab2.local security event log: "Event: 4625. Security ID: NULL SID (...) Authentication package: NTLM (...) – donmelchior Jan 14 at 11:14

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.