"FSMO Roles" #6 & 7 are handled in Microsoft AD Integrated DNS. So why the fuss over that? You are reading vendor material from a vendor attempting to frighten you into believing you can't "do AD" without their stuff. Pure FUD.
I have setup many bidirectional trusts with no issues. Calm down, take a deep breath and go for a nice walk to sooth your nerves. Thanks Webster > -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Klaus Hartnegg > Sent: Saturday, March 14, 2015 7:57 AM > To: '[email protected]' > Subject: [NTSysADM] Pitfalls in setting up domain trust > > Hi, > > We need bidirectional trust between two AD domains. I had already tested > everything in virtual machines, and set up conditional forwarding to the other > domains DNS servers. But then I stumbled over a note that trust requires > manual changes to the allocation of the 5 FSMO roles to the servers. > Otherwise it will slowly introduce nasty errors into the AD. > Source: last sentence before section 'References' on > https://en.wikipedia.org/wiki/Flexible_single_master_operation > > I had not expected Microsoft to create *such* pitfalls. If something is > complicated to set up, that is one thing. But that straight forward procedure > can easily lead to a situation in which everything appears to work, yet behind > the scenes it slowly destroys itself, that is perfidious! > > Further research revealed some more pieces of the puzzle, including the info > that there are not 5 FSMOs, but 7!?! > Sources: > https://u-tools.com/help/FSMORoles.asp > https://lists.samba.org/archive/samba/2014-November/187078.html > > Now I wonder how many more unpleasant surprises are hidden on this path, > not necessarily limited to FSMOs. Is there a document with a definite list of > all prerequisites for bidirectional domain trust? Or is such info only > accessible > by MCSEs, such that self-taught admins will reliably be punished if they dare > to do this themselves? > > Thanks, > Klaus >
