[ActiveDir] Connectivity with FSMO role machines

[Abbiss, Mark]

Title: Message

Probably a dumb question but here goes.   We have recently installed a new DC into our domain to manage an increasing number of machines located in a DMZ. The domain itself is spread across two locations Germany and France. The new DC has open connectivity to the DC's that are located in Germany, however thanks to various political and bureaucratic idocies, there is not open connectivity with the DMZ and the FSMO holding DC's in the French location.   This means that the new server is currently unable to create new users or other objects as it is unable to connect with the RID master.   My question: Is there a way around this problem apart from opening up the connectivity from the DMZ to France (which will never be allowed) or secondly moving the RID master to a DC in Germany (which will be a nightmare of discussions and arguements)   Many thanks