Hi,
We need bidirectional trust between two AD domains. I had already tested
everything in virtual machines, and set up conditional forwarding to the
other domains DNS servers. But then I stumbled over a note that trust
requires manual changes to the allocation of the 5 FSMO roles to the
servers. Otherwise it will slowly introduce nasty errors into the AD.
Source: last sentence before section 'References' on
https://en.wikipedia.org/wiki/Flexible_single_master_operation
I had not expected Microsoft to create *such* pitfalls. If something is
complicated to set up, that is one thing. But that straight forward
procedure can easily lead to a situation in which everything appears to
work, yet behind the scenes it slowly destroys itself, that is perfidious!
Further research revealed some more pieces of the puzzle, including the
info that there are not 5 FSMOs, but 7!?!
Sources:
https://u-tools.com/help/FSMORoles.asp
https://lists.samba.org/archive/samba/2014-November/187078.html
Now I wonder how many more unpleasant surprises are hidden on this path,
not necessarily limited to FSMOs. Is there a document with a definite
list of all prerequisites for bidirectional domain trust? Or is such
info only accessible by MCSEs, such that self-taught admins will
reliably be punished if they dare to do this themselves?
Thanks,
Klaus
