Windows Forum

Ask something
Discussion Locked

win2k trust relationship /policy

0 helpful
3 replies

by avmw

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

HAI FRIENDS,HAI.....

I WILL EXPLAIN THE SCENARIO IN DETAIL....

ACTUALLY I HAVE 1 WIN2K SERVER, 1 DATABASE SERVER AND 10 THIN CLIENTS.

(1)
I HAVE CONFIGURED THE ACTIVE DIRECTORY OF EACH SERVER AS TWO =

SEPERATE DOMAINS(TWOSEPERATE FORESTS).

I HAVE CONFIGURED TERMINAL SERVER IN THE 1st SERVER.CREATED 5 DIFFERENT
USERS.I HAVE PUT ALL THE FIVE IN A SEPERATE ORGANISATIONAL UNIT (OU)
AND SET UP THE GROUP POLICY FOR THAT PARTICULAR OU.(Eg.HIDE THE DRIVES FR=
OM MY
COMPUTER, REMOVE DISPLAY FROM CONTROLL PANEL...)
EVRYTHING IS WORKING FINE WHILE WORKING WITH THE THIN CLIENTS(THROUGH TS
logon localy).
THEN I MADE TRUST RELATIONSHIP(BOTH WAYS) BETWEEN THE TWO DOMAINS.BUT WHI=
LE
ATTEMPTING TO LOGIN WITH A USERFROM THE OTHER DOMAIN IT IS GIVING THE ER=
ROR
AS "the local policy of the system does not allow to login"
WHEN I TRIED TO GIVE THE local logon PERMISSION TO THAT USER FROM THIS DO=
MAIN
(through ADMIN TOOLS -- DOMAIN CONTROLLER SECURITY POLICY),
THE ERROR IS "unable to contact the domain".BUT IT IS SHOWING THE DOMAIN =
IN
THE WINDOW AND ALSO I'M ABLE TO BROWSE THE OTHER SERVER.

THEN I TRIED FOR THE SECOND SERVER AS ADDITONAL DOMAIN CTRLER .....
CHILD DOMAIN...... TREE WITHIN A FOREST... BUT ALL IN VAIN WITH =

THE SAME ERROR.
I HAVE CHECKED THE DNS NAME... AND ALL PARAMETERS FOR AD.

(2)

THEN I MADE THE SECOND SYSTEM AS WIN2K PRO, AND MADE IT AS THE CLIENT OF =
1st
SERVER.HERE ALL ARE OK..DATABASE IS WORKING FINE..
BUT THE POLICIES SET FOR THE USERS ARE NOT WORKING WHILE LOGGING IN THIS
MACHINE.THIS IS THE ACTUAL PROBLEM NOW.GROUP POLICY HAS TO BE MADE ROAMIN=
G.

CUSTOMER IS VERY PARTICULAR FOR THIS GROUP POLICY.

(Also tell me how to make policies for individual users and groups.)

I'M EXPECTING UR MAIL SOON... AT LEAST FOR THE SECOND PROBLEM

PLEASE REP SOON
THANX IN ADVANCE
AVM

3 replies

by beermonster

Hi,
Roaming group policy ??? Not sure what you mean by that. If I understand you correctly, there is either a whole group policy, or specific settings within a group policy that are not being applied to the workstation. On the assumption that the whole thing is not being processed, use the technique in technet article Q221833
to turn on logging, this will show you if there has been attempt to process the GPO at all and may point to what is stopping it. Also check the acl on the policy fileitself in sysvol as this would prevent processing. If only some parts of the gpo are applying, check the OU hierarchy for no override settings that may be cancelling the required settings out. If there is a slow link between server and workstation, then by default some parts of the policy will be skipped - again search on technet for more details. To apply a setting to an individual user or group, you will need to put them in their own OU. if there is a special additional setting just for them then nest the OU's so they get the settings above them as well, or link them which means you can edit the order they run in. Stopping a gpo applying to a user or group is a little easier. edit the acl for the policy file in sysvol to deny them accessif you don't want to move them. As for your first problem it is almost certainly dns related, as locating a domain controller is achieved by sending a getdcname request to dns. If these were seperate domains then each would have its own dns server, neither of which would have a record of the DC's in the other.

This discussion is closed to new replies.