Possible to have inter-forest trust between subdomains of two forest

Sponsored Links

I'm hoping Windows 2008 may have lifted the limitation that inter-forest
trusts have to be done at the top domain level.

There's a large forest for our parent company, but need a trust for using
their servers in our assigned subdomain. Our pre-existing forest is separate
from the parent company. It's not politically possible to get them to allow
a root level trust to the whole corporation just for our one relatively small
external forest.

Any options available? (besides migrating our users to their forest)

Thanks...

Mike,
assuming that you do not have an existing forest trust between two forest,
you can simply create an external trust relationship between respective
domains (obviously you will effectively lose all the benefits of the forest
trust)...

hth
Marcin

"Mike Webb" <Mike Webb@discussions.microsoft.com> wrote in message
news:54962D50-747E-4994-855E-59DFAA5B625B@microsoft.com...
> I'm hoping Windows 2008 may have lifted the limitation that inter-forest
> trusts have to be done at the top domain level.
>
> There's a large forest for our parent company, but need a trust for using
> their servers in our assigned subdomain. Our pre-existing forest is
> separate
> from the parent company. It's not politically possible to get them to
> allow
> a root level trust to the whole corporation just for our one relatively
> small
> external forest.
>
> Any options available? (besides migrating our users to their forest)
>
> Thanks...

Hello Mike,

You can use a one/two-way external trust:
http://technet.microsoft.com/en-us/l.../cc816837.aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> I'm hoping Windows 2008 may have lifted the limitation that
> inter-forest trusts have to be done at the top domain level.
>
> There's a large forest for our parent company, but need a trust for
> using their servers in our assigned subdomain. Our pre-existing
> forest is separate from the parent company. It's not politically
> possible to get them to allow a root level trust to the whole
> corporation just for our one relatively small external forest.
>
> Any options available? (besides migrating our users to their forest)
>
> Thanks...
>

Just because you can't have a forest trust doesn't stop domain trusts. This
is possible in Windows 2003, no need to upgrade to 2008 just for this.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.


"Mike Webb" <Mike Webb@discussions.microsoft.com> wrote in message
news:54962D50-747E-4994-855E-59DFAA5B625B@microsoft.com...
> I'm hoping Windows 2008 may have lifted the limitation that inter-forest
> trusts have to be done at the top domain level.
>
> There's a large forest for our parent company, but need a trust for using
> their servers in our assigned subdomain. Our pre-existing forest is
> separate
> from the parent company. It's not politically possible to get them to
> allow
> a root level trust to the whole corporation just for our one relatively
> small
> external forest.
>
> Any options available? (besides migrating our users to their forest)
>
> Thanks...

Forgot the link to help you out
http://technet.microsoft.com/en-us/l.../cc728307.aspx

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.


"Paul Bergson [MVP-DS]" <pbbergs@nopspam_msn.com> wrote in message
news:33E93566-AD49-41B8-8A1E-19CC29C803D1@microsoft.com...
> Just because you can't have a forest trust doesn't stop domain trusts.
> This is possible in Windows 2003, no need to upgrade to 2008 just for
> this.
>
> --
> Paul Bergson
> MVP - Directory Services
> MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> 2008, 2003, 2000 (Early Achiever), NT4
>
> http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewsGroup This
> posting is provided "AS IS" with no warranties, and confers no rights.
>
>
> "Mike Webb" <Mike Webb@discussions.microsoft.com> wrote in message
> news:54962D50-747E-4994-855E-59DFAA5B625B@microsoft.com...
>> I'm hoping Windows 2008 may have lifted the limitation that inter-forest
>> trusts have to be done at the top domain level.
>>
>> There's a large forest for our parent company, but need a trust for using
>> their servers in our assigned subdomain. Our pre-existing forest is
>> separate
>> from the parent company. It's not politically possible to get them to
>> allow
>> a root level trust to the whole corporation just for our one relatively
>> small
>> external forest.
>>
>> Any options available? (besides migrating our users to their forest)
>>
>> Thanks...
>

Sorry, I should have been more specific. The corporate forest contains an
Exchange 2007 server we want to use. Users in our forest would need to have
mailboxes on the external forest's exchange server.

I missed the Note here that says it's possible:
http://technet.microsoft.com/en-us/l.../aa998031.aspx

"Although we recommend that you create a forest trust, you can create either
a forest trust or an external trust. If you create an external trust, when
you create linked mailboxes in Step 3, on the Master Account page of the New
Mailbox wizard, you must specify a user account that can access the domain
controller in the trusted forest. You cannot use the credentials with which
you are currently logged on. If you create linked mailboxes by using the
New-Mailbox cmdlet, you must specify a user account that can access the
domain controller in the trusted forest by using the LinkedCredential
parameter. "


Thanks for your help.



"Paul Bergson [MVP-DS]" wrote:

> Just because you can't have a forest trust doesn't stop domain trusts. This
> is possible in Windows 2003, no need to upgrade to 2008 just for this.
>
> --
> Paul Bergson
> MVP - Directory Services
> MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> 2008, 2003, 2000 (Early Achiever), NT4
>
> http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewsGroup This
> posting is provided "AS IS" with no warranties, and confers no rights.
>
>
> "Mike Webb" <Mike Webb@discussions.microsoft.com> wrote in message
> news:54962D50-747E-4994-855E-59DFAA5B625B@microsoft.com...
> > I'm hoping Windows 2008 may have lifted the limitation that inter-forest
> > trusts have to be done at the top domain level.
> >
> > There's a large forest for our parent company, but need a trust for using
> > their servers in our assigned subdomain. Our pre-existing forest is
> > separate
> > from the parent company. It's not politically possible to get them to
> > allow
> > a root level trust to the whole corporation just for our one relatively
> > small
> > external forest.
> >
> > Any options available? (besides migrating our users to their forest)
> >
> > Thanks...
>