Klaus, Did you happen to follow the citation link (#6) back to the Microsoft KB article that was written in 2007?
On Saturday, March 14, 2015, Klaus Hartnegg <[email protected]> wrote: > Hi, > > We need bidirectional trust between two AD domains. I had already tested > everything in virtual machines, and set up conditional forwarding to the > other domains DNS servers. But then I stumbled over a note that trust > requires manual changes to the allocation of the 5 FSMO roles to the > servers. Otherwise it will slowly introduce nasty errors into the AD. > Source: last sentence before section 'References' on > https://en.wikipedia.org/wiki/Flexible_single_master_operation > > I had not expected Microsoft to create *such* pitfalls. If something is > complicated to set up, that is one thing. But that straight forward > procedure can easily lead to a situation in which everything appears to > work, yet behind the scenes it slowly destroys itself, that is perfidious! > > Further research revealed some more pieces of the puzzle, including the > info that there are not 5 FSMOs, but 7!?! > Sources: > https://u-tools.com/help/FSMORoles.asp > https://lists.samba.org/archive/samba/2014-November/187078.html > > Now I wonder how many more unpleasant surprises are hidden on this path, > not necessarily limited to FSMOs. Is there a document with a definite list > of all prerequisites for bidirectional domain trust? Or is such info only > accessible by MCSEs, such that self-taught admins will reliably be punished > if they dare to do this themselves? > > Thanks, > Klaus > > > -- -- Espi (via mobile)
