RE: [ActiveDir] Communication across a trust...with firewalls

[Ken Cornetet]

I've just been troubleshooting the same scenario. I think you are correct - the member servers want to talk directly to a DC in the domain containing the user in question. They do not ask their own DC to do the authentication.   I know this is the case when you add a user from the trusted domain to a local group on the member server. The member server looks in DNS to find all the domain controllers for the user's domain, does what I guess would be called an "LDAP ping", then starts talking to the first DC that answers back.   Ethereal is your friend! From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, March 14, 2006 10:35 AM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Communication across a trust...with firewalls Within a domain, when a user’s credentials are presented to a member server, that member server communicates with the domain controller to validate the creds.   We have a cross-forest (cross–company; a divestiture) trust set up that we are testing.  A member server in the other forest/domain and across the firewall is having trouble authenticating credentials from our domain.  Their DC works fine.  Ports on the firewall are only opened for the two domain controllers (one on each side).   Here’s the question:  in order to validate the “foreign” credentials, should the member server be looking first to its own DC, or is it trying to cross the firewall to find our DC?  Based in the preliminary traffic sampling so far, I think that’s what is happening.  Is that normal/expected behavior?   TIA, AL Al Maurer Service Manager, Naming and Authentication Services IT | Information Technology Agilent Technologies (719) 590-2639; Telnet 590-2639 http://activedirectory.it.agilent.com