Trust issue - Windows Server 2003, Windows 2000.

  • Thread starter Thread starter Fredrik Landin
  • Start date Start date
F

Fredrik Landin

2000 Domain is in native mode, 2003 domain and forest functional level 2003.

These are the LMHOST files on both DC, yes they differ when it comes to the
names of the servers and IP/Domain. This is just to show what it looks like.
-
192.168.0.10 SERVERNAME #PRE #DOM:DOMAIN #net group's DC
192.168.0.10 "DOMAIN \0x1b" #PRE
-
Additionally there are entries in the HOSTS file:
192.168.0.10 servername.domain.se
-
I can ping on netbios name, fqdn or whatever I want, I can map drivers and
so on.
To me it looks like name resolution is a-ok!

The networks pass trough on router on the way, this is a new router without
any configuration/limitation as far as ACLs go, I even allow broadcast right
now.

Here's the problem.
Domains and trust, new trust [Welcome to the new trust wizard] - next, I
type the netbios name of the domain - next, I get the username and password
dialog, I try to type any of these and I still get the same result, usename
and password, domain\username and password, username@domain and password.
All of these give me the same result immediately, "Cannot Continue, The
trust relationship cannot be created because the following error occurred:
The operation failed. The error is: Access is denied."

If I try to create a trust and don't type the netbios name of the domain but
use domain.se I get another wizard asking me for the appropriate trust,
Realm or Windows trust.
I select Windows trust and get this: "Cannot Continue, The trust
relationship cannot be created because the specified domain cannot be
contacted.
Either the domain does not exist, or network or other problems are
preventing connection."

Both accounts I'm trying to use in both domains are enterprise admins, if it
would help I can create two brand new accounts in both domains to solve this
issue (if suspected something with this.)

The info above leads me to believe that name resolution is the issue in some
way. but I'm at a loss and need help.
Anyone out there who has done this before and maybe have a solution for
this?


Regards,
Fredrik


--
 
Hi Fredrik. It sounds like name resolution is the most likely cause of the
problem. Make sure that each domain has DNS name resolution to the other.
One way to do this is to set up a secondary DNS zone for domain2 on domain1
and vice versa. To verify that we are able to find a DC in the other
domain, run nltest /dsgetdc:<domain name>.

I don't think you should need an lmhosts file since the domains are
Win2k/Win2k3, but note that the "DOMAIN \0x1b" part must have 20 characters
withing the quotes (add additional spaces between DOMAIN and \0x1b)....so
the line you used below would be:

192.168.0.10 "DOMAIN \0x1b" #PRE

See the following article for more information on lmhosts:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;180094

--
Jimmy Harper [MSFT]
Directory Services
This posting is provided "AS IS" with no warranties, and confers no rights

Fredrik Landin said:
2000 Domain is in native mode, 2003 domain and forest functional level 2003.

These are the LMHOST files on both DC, yes they differ when it comes to the
names of the servers and IP/Domain. This is just to show what it looks like.
-
192.168.0.10 SERVERNAME #PRE #DOM:DOMAIN #net group's DC
192.168.0.10 "DOMAIN \0x1b" #PRE
-
Additionally there are entries in the HOSTS file:
192.168.0.10 servername.domain.se
-
I can ping on netbios name, fqdn or whatever I want, I can map drivers and
so on.
To me it looks like name resolution is a-ok!

The networks pass trough on router on the way, this is a new router without
any configuration/limitation as far as ACLs go, I even allow broadcast right
now.

Here's the problem.
Domains and trust, new trust [Welcome to the new trust wizard] - next, I
type the netbios name of the domain - next, I get the username and password
dialog, I try to type any of these and I still get the same result, usename
and password, domain\username and password, username@domain and password.
All of these give me the same result immediately, "Cannot Continue, The
trust relationship cannot be created because the following error occurred:
The operation failed. The error is: Access is denied."

If I try to create a trust and don't type the netbios name of the domain but
use domain.se I get another wizard asking me for the appropriate trust,
Realm or Windows trust.
I select Windows trust and get this: "Cannot Continue, The trust
relationship cannot be created because the specified domain cannot be
contacted.
Either the domain does not exist, or network or other problems are
preventing connection."

Both accounts I'm trying to use in both domains are enterprise admins, if it
would help I can create two brand new accounts in both domains to solve this
issue (if suspected something with this.)

The info above leads me to believe that name resolution is the issue in some
way. but I'm at a loss and need help.
Anyone out there who has done this before and maybe have a solution for
this?


Regards,
Fredrik
Click to expand...
 
Back
Top