Computing.Net > Forums > Windows 2000 > Domain Trusts and Functional Levels

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Domain Trusts and Functional Levels

Reply to Message Icon

Original Message
Name: Machivelli
Date: August 15, 2005 at 14:08:00 Pacific
Subject: Domain Trusts and Functional Levels
OS: Windows 2000
CPU/Ram: Xeon 2.4GHz 4GB Ram
Comment:

Scenario:
Domain 1:
Windows 2000 Domain (Pure, no NT4 BDC’s)

Domain 2:
Windows NT4 SP4

Trust:
One way trust, Domain 2 trusts Domain 1


The former Admin swore up and down that you had to remain in 2000 Mixed mode for this Trust to function. I come in (mop and broom in hand) after the fact, take one look at the domain and ask why are we not in Native mode? We are a pure Win 2000 environment, and according to the documents, we can and should move to Native mode. Insert Director who was sold on the Mixed mode idea from the former Admin. The Director is not going to budge on this until I show her concrete proof that we can move to 2000 Native mode (more importantly to 2003 as I’m in the middle of upgrading the domain) and not destroy the one way trust with the NT4 Domain, which is vital to performing the departments duties. I’ve ‘Googled’ this thing to death, I can find information about trusts, and information about functional levels, but nothing tying the two together, namely NT4 and Windows 2000 Native. Anybody out there know of an article, or can give a testimonial of how they have this working?


Report Offensive Message For Removal


Response Number 1
Name: bob819
Date: August 16, 2005 at 05:08:27 Pacific
Reply:

IMHO your Director is right, go Native mode on Domain1 & Domain2 will lose sight of it.
Why not upgrade Domain2 to 2000 ADS then go Native? sounds like a good weekend's work to me but get it wrong and it's pink slip time!
Always go one step at a time on networks, to paraphrase an oldie from my previous life, "There are old Admins & Brave Admins but there are no old & brave admins!"
Best of luck.

Bob Mitchell.
"There is no reason for any individual to have a computer in their home."
- Kenneth Olsen, president and founder of Digital Equipment Corp., 1977.


Report Offensive Follow Up For Removal

Response Number 2
Name: Machivelli
Date: August 16, 2005 at 07:28:43 Pacific
Reply:

Domain 2 is a shared resource with another department. It’s running some legacy applications that prevent it from upgrading to Win2K. It’s planned for an upgrade in the coming months, but as I work for a State “Institution” months will be more like years. ;)

Question, if you are not replicating data to the NT4 PDC in Domain 2, then why would the functional level affect it? If you have any insight on something I’m missing I’d appreciate it.

Currently we have the lmhost file configured with all three of our Win2k/2k3 DC’s. The only glitch we had was when he dropped the Win2k3 DC security template on one our new 2k3 servers then moved PDC emulation to it. Part of the security template sets the LAN Manager auth level to send NTLMv2\refuse LM. This of course kills the communication between the two domains. You can install DSClient on the NT4 server to enable NTLMv2, since this is a shared resource we decided to disable this setting and save ourselves the red tape and headaches of installing it.


Report Offensive Follow Up For Removal

Response Number 3
Name: bob819
Date: August 16, 2005 at 08:10:19 Pacific
Reply:

I assumed that Domain2 was talking to Domain1 but of course they will be talking to each other(in simple terms) since it is more than possible that domain1 is accessing shares on Domain2 and going native will probably cause a lot of problems only some of which will be obvious.
As I said, I'd leave it well alone until they decide they can upgrade Domain2. From a performance point of view the risks far outweigh the doubtful benefits.

Bob Mitchell.
"There is no reason for any individual to have a computer in their home."
- Kenneth Olsen, president and founder of Digital Equipment Corp., 1977.


Report Offensive Follow Up For Removal

Response Number 4
Name: wanderer
Date: August 16, 2005 at 16:34:53 Pacific
Reply:

Perhaps this will help
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/31915de7-ff58-4f26-a8ec-450ffca75912.mspx

Apparently in AD you can make EXTERNAL TRUSTS with NT4, as you can see from the diagram in the link.

What I get from this is an external trust has nothing to do with wheither your AD domain is mixed or native.

This makes sense if you review why mixed mode exists. Mixed has bdcs replicating with the pdc emulator. This is NOT a trust. A TRUST IS BETWEEN DOMAINS though it can also be a trust between domains in the same AD forest.

This is based on the assumption that the AD domain and the NT domain are using DIFFERENT names. Since NT domain is NOT part of the AD tree/forest mixed mode vs native DOESN'T COME INTO PLAY. It would only come into play IF the NT domain was in the AD Forest.

PS that was 1 minute on google to get the external trusts and another minute to search on "external trusts active directory".

I hope this helps.


Report Offensive Follow Up For Removal







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows 2000 Forum Home



Results for: Domain Trusts and Functional Levels

Win2k Trusts and Domains
    Summary: Andy, some of your terms are a bit misused. The term Operations Master defines many roles. There is no "Operations Master". These Operation Masters, usually refered to as FSMO roles are things like ...
www.computing.net/answers/windows-2000/win2k-trusts-and-domains/15599.html

Domain Trust
    Summary: we have 2 windows 2000 networks. One in the US and one in the UK. we setup our cisco as a router and now the two networks can see each other fine! I want to have a domain trust! so i gave both syste...
www.computing.net/answers/windows-2000/domain-trust-/20204.html

Win 2000 server into a NT domain,Trust
    Summary: A W2K server running AD can not be part of an existing NT4 domain, it is a new domain in a new forest,new tree. If the W2K server was not running AD it could join an existing NT4 domain as a member se...
www.computing.net/answers/windows-2000/win-2000-server-into-a-nt-domaintrust/28105.html








Which MP3 player do you have?

iPod/iPhone
Zune
Something Else
None


View Results

Poll Finishes Today.
Discuss in The Lounge
Poll History






Data Recovery Software