Networks

Ask something
Question Locked

Active Directory

0 helpful
13 replies

by avi

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am a new employee at our organization and have been tasked with general IT responsibilites. We have an IT consultant but they do not seem to be much help. We currently have 2 offices. 1 has about 20 users running windows server 2000, the other has 3 but could grow to up to 10, running windows server 2003. Each is currently running its own file server and domain controler and active directory. The two are site-to-site VPN'd into each other. For some reason when the network was setup each individual computer (almost exclusively laptops) were not set as being on the domain . The login names in the active directory mirror the user names on each computer. Right now, when there is a new user or a change to a user, I have to go through and change the active directory entry on both the main office server and the branch office server. Is there a way to replicate the active directory (i'm not sure this is actually what I should be asking) so that I don't have to go through and change everything twice? Is the fact that everything is already setup going to mess up my current configuration?

Thanks.

13 replies

by churdoo

Being 2 distinct AD's as you've indicated, there is no way to "synchronize" for lack of a better term, the users of the 2 AD's.

Users at both sites need to access resources at both sites? You can set up a 2-way trust between the 2 AD's so that you only have to create user accounts in the user's home AD.

One other option: How much work would be involved, or is it feasible with regard to your company infrastructure, to demote the server in the 3-person office down, eliminating that separate AD, and then promote it, either into the same AD or as a child AD as the 20-user office?

by avi

Churdoo,

Thanks so much for the help. I apologize for what will likely be very basic questions.

1. For some reason the two domains do not seem to recognize each other. If I ping one domain it is not seen by the other one. This has prevented me from creating two way trusts.

2. I'm not sure how much work or what the process is for demoting one server than then promoting it into the same AD or as a child AD. Our IT consultants seem to think that a single domain will be inefficient through the internet.

Both sites are VPN'd to each other.

Thanks for any help you can offer, and if you can point me to useful resources I would appreciate it.

by churdoo

The reason that you can't ping each other is most likely related to DNS resolution. Since the sites are connected via VPN, when you try to ping something on the other side of the tunnel, broadcast traffic does not cross the tunnel, therefore it is imperative that you have DNS resolution for both domains at each site.

I'm assuming that you have the clients at each site resolving to their local DC, and each DC forwarding to the respective ISP DNS resolvers, or to root hints.

Add to this at each site, set up a secondary forward lookup zone for the domain on the opposite side of the tunnel. You may have to manually assign each server as NAMESERVER in the AD-integrated zones in order to get the DNS zone to load on the secondaries, however once the secondary loads, you'll have "pingage" and will be able to set up the trust(s) between the existing AD's, and/or will be able to create child AD or whatever you want/need to do.

by avi

Thanks again. Two main problems. (1) in the primary office (windows server 2000), i have setup the smaller office as a secondary forward lookup zone. Isee all of the dns entries. I still cannot, however, ping that domain controller from within the office. For the smaller office (windows server 2003), i cannot setup the secondary forward lookup zone (or stub). I get the error: Zone Not Loaded by DNS Server.

Any ideas why this might be? As a side note, our domain in the large office is named the same thing as our website address and is forwarding www. to the web address from within the large office network. Is it possible this is confusing the small office dns when it is looking up that domain?

by churdoo

Didn't want to indent yet another level.

Problem 1) How are you trying to ping the server? Meaning, are you trying to "ping secondserver" or "ping secondserver.secondsite.com"? The latter is required unless you add the second site domain name in your DNS search path. Another test is to use "nslookup" instead of ping; "nslookup secondserver" or "nslookup secondserver.secondsite.com" and check the results.

Problem 2) To add the secondary zone at the smaller office, in the DNS server at the large office, manually add the IP of the small office DC as a NAMESERVER of the large office forward lookup zone, and the DNS zone should now load at the small office.

by avi

Ok, thanks again for all of the help. This is going to be long, but figured I would give you all the info i had.

Problem 1) Lets just talk about nslookup.

From the large office server (Server 1), this is what i get:

server1 - resolved to server1.site.1.com with correct ip address

server1.site1.com - Resolved to server1.site1.com with correct ip address

server 2 - server1.site1.com can't find server2: non-existent domain

Server2.site2.local - resolved to server2.site2.local with correct ip addresses.
All of these indicate that the lookup came from server1.site1.com with the correct IP address

From the small office server (Server 2), this is what i get:

server1 - server2.site2.local can't find server1: non-existent domain.

server1.site1.com - server2.site2.local can't find server1.site1.com: non-existent domain.

server 2 - resolved to server2.site2.local with correct ip address

Server2.site2.local - resolved to server2.site2.local with correct ip addresses.

All of these indicate that the lookup came from server2.site2.local with the correct IP address

From a workstation physically within site 1 (site 1 is site-to-site VPN'd into site 2):

server1 - Unknown can't find server1: non-existent domain

server1.site1.com - resolved to server1.site1.com with correct ip address.

server 2 - Unknown can't find site2: non-existent domain

Server2.site2.local - resolved to server2.site2.local with correct ip addresses.

All of these indicate that the lookup came from Unknown with the IP address from server1.site1.com

Problem 2) I have added the IP address of server2.site2.local as a nameserver in site1.com's forward lookup zone at the large office. This did not cause the secondary zone of site1.com at site2.local to be added correctly. I still get the error "zone not loaded by DNS Server".

I have a feeling these issues are related?
Thanks again for the help!

by churdoo

The only things missing are

1) adding the remote DNS names to the DNS suffixes list. In other words, in site1.com, add the DNS suffix site2.local to the DNS suffixes list in TCP/IP properties / advanced / DNS (you can add this to DHCP also). This will make it so that "server2" will resolve, without having to use "server2.site2.local"
And add site1.com to the DNS suffix list at site2

2) fix the problem with loading the secondary DNS zone at site2.

by avi

I did as instructed for 1. I still can't do an nslookup from site2 to to site1, but i think that is because of problem 2.

Problem 2) i did as you instructed in the last post, but like I said before, i still get the error in the site1.com zone on site2's dns. They are VPN's so it shouldn't be a open port issue, and I don't know how else to have site2 see site1. Any more ideas?

Thanks again!

by churdoo

In Server1, as I recall is the W2000 Server at site1, in the forward lookup zone of site1.com / Properties, you should add the private IP of Server2 to the Nameservers tab.

In Server2, as I recall the W2K3 server at site2, in the Secondary zone for site1.com (and this should be a Secondary, and not a Stub zone), the Zone Master should be the private IP of server1.

If these are already set up this way and still not transferring the zone, fish through the event viewer for pertinent errors. Post back or PM me for a gotomeeting.

by avi

For some reason, the like 700th time I went through the settings and recreated the new zone it seems to have worked. Thank you for you help with DNS.

Now, i seem to have another issue, which I neglected to consider, but I'm not sure there is actually a way around it. The office2 server is running Windows SBS 2003 which does not allow trusts and must be the primary domain.

My understanding is that I need to either (1) give up and keep operating like we have (2) upgrade SBS to the standard version of Server 2003 or (3) somehow change the office1 server so it is in the same domain as office 2 and is being controlled by office2, not a prefered solution since office 1 is the server that gets more use as a fileserver, database server and radius server to authenticate VPN users. Plus, I'm not sure thats even possible with Windows Server 2000.

I'm probably either stuck with 1 or 2 and 2 seems like a much more involved process that I was planning to commit, unless I am missing something.

Thanks again for your help.

by churdoo

... or if you did, I missed it.

You are right about Trust functionality being disabled in SBS, but if you're using the exchange features of SBS, then I wouldn't transition to non-SBS there.

Also, if it were me, I wouldn't want to do option 3 and convert that server to the same AD. There's not reason you can't do it, because in fact you CAN join a server running W2K Server or W2K3 Server and promote it to a DC in an SBS AD no problem. I'm only saying I wouldn't do it here using the existing W2K server, but I WOULD consider doing that as part of a plan to REPLACE the site1 W2K server as part of that site's normal server refresh.

Option 1 may not be so bad .... especially if, I'm not sure it still works this way as I haven't tried it recently, but if you set identical usernames and passwords in each of the separate AD's, then the users may not be asked for credentials as they try to access resources between the two AD's. Or the worst case is that a user will be prompted with a "connect as" dialogue when they try to access resources across AD's, which they will just have to provide their user/pass again.

by avi

Thanks again. I think I may have left that crucial piece of information out. I wasn't aware it was going to have an impact. We actually DON'T use the Exchange server functionaliy of SBS 2003. I'm not actually sure why it was purchased in the first place. We use, instead, a hosted exchange solution. That being the case, I'm not sure option 2 is that bad, although you are right to say I may just be better of staying where I am.

This discussion is closed to new replies.