Troubleshooting Trust Relationships.

What is actually happening when NETDOM tries to verify trusts?

-- I have numerous servers in an NT4 Domain. There is a bi-directional trust
established between the NT4 Domain and an AD Domain. I am wanting to grant
permissions on the servers to members of the AD domain. This will work on
all but two of my servers. On these two servers I get errors about therer
being NO TRUST between the two domains. Running NETDOM QUERY
/DOMAIN:addomain TRUST responds with there being no trust between the two
domains.

I have verified WINS is working. I have verified the TRUST is established
between my NT4 PDC and the AD DC. Other servers on the same subnet and NT4
domain are working correctly.

I am at a loss as to what to try next.

Thansk
Carl

> What is actually happening when NETDOM tries to verify trusts?
>
>-- I have numerous servers in an NT4 Domain. There is a bi-directional trust
>established between the NT4 Domain and an AD Domain. I am wanting to grant
>permissions on the servers to members of the AD domain. This will work on
>all but two of my servers. On these two servers I get errors about therer
>being NO TRUST between the two domains. Running NETDOM QUERY
>/DOMAIN:addomain TRUST responds with there being no trust between the two
>domains.
>
>I have verified WINS is working. I have verified the TRUST is established
>between my NT4 PDC and the AD DC. Other servers on the same subnet and NT4
>domain are working correctly.
>
>I am at a loss as to what to try next.
>
>Thansk
>Carl
>
>
>
Carl,

If some servers int he AD domain can add users from the NT domain to their shared resources then i would think that the trust is working just fine and that
the trust is not thi issue. Make sure that is the case first and that will help narrow the issue to just the two or so server that you mentions here.

If these server are not able to make use of the trust relationship then there may be a name resolution issue. Are all of the server, the ones that are
working and the ones that are not working pointing to the same WINS and DNS Server for name resolution?

I suspect that an LMHOSTS file may be playing a role here? nbtstat -c will show all name in the lcal NetBIOS name cahce. Anything with a -1 life is a
record that is being pre-loaded into the name cache by an LMHOSTS File.

T.J. Campana [MSFT]
Microsoft EPS Networking
--
This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from which they originated.