Home / server / Questions / 207055
In Process
nick3216
Asked: 2010-11-30 09:14:27 +0800 CST

Domain Trust 2008 to 2003

  • 772

I'm having trouble setting up the trust relationship between a Windows Server 2003 and a Windows Server 2008 AD.

Domain a is Windows Server 2003 Forest functional level.

Domain b is a Windows Server 2008 Forest functional level.

I can set up the incoming side of the trust relationship on domain "a" so that it trusts domain "b".

Try as I might on domain "b" I can't set up the outgoing side of the trust relationship to domain "a".

The GUI interface gives an unhelpful 'The request is not supported'.

I'm not sure netdom is being more or less helpful as it refers me to FilterSIDs

netdom trust /add b /uo:b\admin /po:* /d:a /ud:a\admin /pd:* /oneside:trusting
To improve the security of this external trust, security identifier (SID)
filtering is enabled, however, if users have been migrated to the trusted
domain and their SID histories have been preserved, you may choose to turn off this
feature.

For more information about SID filtering and how to turn it off, see the help
for netdom trust /FilterSids or see Help and Support.

The request is not supported.

The command failed to complete succesfully.

I say 'less helpful' because Windows Server 2008 doesn't support the /FilterSIDs option.

How can we force creation of this trust?

Edit: Just to clarify I've checked that the [Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options] "Network access: Allow anonymous SID/Name translation” is enabled on both sides of the trust as per http://social.technet.microsoft.com/Forums/en/winserverDS/thread/cc61fc25-3569-4413-bbfd-92390eb31118

windows-server-2008 windows-server-2003 active-directory

1 Answers

  1. I can set up the incoming side of the trust relationship on domain "a" so that it trusts domain "b".

    This is strange. Because if the trust is incoming on domain a it means a is the trusted domain. ie: b trusts a.

    Try to set the outgoing part of the trust first.

    Your command tries to create the outgoing (trusting) part of the trust on domain b only. I think you need to set a trust password in this case. See: http://technet.microsoft.com/de-de/library/cc835085(WS.10).aspx

    TRUSTING: Specifies to create or remove the trust object on the trusting domain. This value is valid only if you specify the /add or /remove parameter. The /passwordt parameter is required when you use the /add or /remove parameter.

    Why do you use /oneside? Why not let netdom create both sides of the trust at once?

    And make sure you don't have DCs with same names in both domains or else verification of the trust will fail.

    • 2