SID Filtering

  • Thread starter Thread starter caddo65590
  • Start date Start date
C

caddo65590

All,
When a trust is created between two domains that does not belong to the same
forest SID filtering is automatically tuned on.
Does any one know how to turn off the SID filtering?
The SIDHist.doc on Microsoft website recommend using Netdom.exe to turn it
off but that is not working for me.
Any ideas?
Thanks
 
Caddo,

I know that you said you tried using netdom and it did not work, but you must use netdom to disable sid filtering. Maybe your syntax was incorrect. Below are two different examples of the syntax that you need. Let me know what error you get if it does not work.

netdom trust DomainA /D:DomainB /UD:DomainB\Administrator /PD:* /UO:DomainA\Administrator /PO:* /Quarantine no

or if this makes more sense:

netdom trust RESDOM /D:ACCDOM /UD:ACCDOM\Administrator /PD:adminpwd /UO:RESDOM\Administrator /PO:"" /filtersids:no


Make sure that you use the netbios domain name with these commands, not the fqdn.

I hope this helps.

Ray Lava
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights
 
Hi Ray, thanks for your quick response.

The command I used is slightly different. I got that from the SIDHist.doc on MS site (TechNet).

That was C:\winnt>netdom /filtersids no DomainB and this command is run from dc on domainA. It doesn't work for me.

I would appreciate if you can explain to me the parameters used in your command line.

What does /D, /UD, /PD:*, /UO means in this syntax?

Can I run this from any computer or the dc in domainA?

If I run the command on the dc in domainA, do I need to specify DomainA as indicated in your command?

Do you have any article on this that I can read?

Even though I have bidirectional trust setup between DomainA and DomainB, users cannot access resource from each other domain without authenticating with a user from the domain containing the resource.

Do you think turning off Sid will resolve this?

Thanks

Caddo,

I know that you said you tried using netdom and it did not work, but you must use netdom to disable sid filtering. Maybe your syntax was incorrect. Below are two different examples of the syntax that you need. Let me know what error you get if it does not work.

netdom trust DomainA /D:DomainB /UD:DomainB\Administrator /PD:* /UO:DomainA\Administrator /PO:* /Quarantine no

or if this makes more sense:

netdom trust RESDOM /D:ACCDOM /UD:ACCDOM\Administrator /PD:adminpwd /UO:RESDOM\Administrator /PO:"" /filtersids:no


Make sure that you use the netbios domain name with these commands, not the fqdn.

I hope this helps.

Ray Lava
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights
 
Back
Top