Multiple Domains in a Forest

[dpanattoni]

I have a situation where two autonomous companies have signed a contract to work together. Both of these companies are using W2K server, both have their own internal domains, Domain1.com and Domain2.com.

All users in Domain1.com are logging into a Terminal Server at Domain2.com in order to run the business software applications.

Because of this setup, all of the users in Domain1.com need to be setup in Domain2.com as well. This is creating a lot of extra maintenance and will only get worse as it looks like another company may join as well. If I make both of these domains part of the same forest, will this allow me to not have to have usernames setup in both domains? If not, how can I change this situation so that both companies are able to keep their domain names but yet users will only need to be setup once?

Thanks in advance.

 

[TwoEdge]

I'll try to help, but I'm fairly new to this so there's only so much I can do. Have you tried to setup a trust relationship between them? As far as I know when you do it, you can share resources between ADs in different forests.

 

[markdmac]

TwoEdge is correct. You need to setup a trust relationship between Domain1 and Domain2. You will then need to grant the Domain1 users login rights on the Domain2 Terminal Server.

 

[dpanattoni]

Thanks guys, I'll give it a try.

 

[GrnEyedLdy]

From TechNet,

http://www.microsoft.com/technet/tr...003/proddocs/standard/sag_AD_Transitivity.asp

"Domains in the same forest are linked with two-way, transitive trust relationships., If child domains are added to the new domain, the trust path flows upward through the domain hierarchy extending the initial trust path created between the new domain and its parent domain.

Transitive trust relationships flow upward through a domain tree as it is formed, creating transitive trusts between all domains in the domain tree.

Authentication requests follow these trust paths, so accounts from any domain in the forest can be authenticated at any other domain in the forest. With a single logon process, accounts with the proper permissions can access resources in any domain in the forest."

 

[anandgjha]

The best solution seems to be create a trust between the two domain.As per your need create a two way or one way trust as per both the companies requirement

 

[dpanattoni]

Thank you very much for the information.

 

[dpanattoni]

Thanks for all of your help. After talking with management of the companies involved, I am going to head a different direction altogether. I now would like to have only one domain name. One of the DCs in Domain1 is a W2003 server. The DC in the Domain2 is a W2k server. I am now looking at what options I have to bring both of these DCs so that they are all working in the same domain without having to readd all of the users, groups, gpo's, etc.