Member Avatar for mhuynh

This is urgent please help!

I have the problem with the trust that we setup for our AD forests, I got the error message when I try to validate the trust;
"The trust cannot be validated for the following reasons.
The secure channel (sc) reset on domain controller \\test.ny.us.com of domain ny.us.com to domain us.com failed with error: they are currently no logon servers available to service the logon request."
1, The 2 domain listed above are in different forests they are not related at all,
Under the us.com I was being able to create the 2 way trusts but got error when I try to validate the trust (The account I use to validate the trust does have all the administrative rights for the ny.us.com).
2. I was unable to create the 2 way trust when I'm on the ny.us.com AD system, I only have the realm trust vailable to pick to create the trust with us.com.
**Even though I already Raise the Functional Level of the trust to Windows 2003 server but I didn't get the option of the External Domain Trust or Forest Trust. I still get the Realm or the Domain Trust options**
Please help,

Thanks,
mai

  • 2 Contributors
  • 1 Reply
  • 568 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by cutepinkbunnies

Dani AI

Generated

Quick, practical checklist for the trust problem reported by . ' tip about local security/NTLM settings is a good starting point; mismatched authentication policies often block cross-domain validation. Below are focused diagnostics and fixes that usually find the root cause without re-creating trusts blindly.

Start in this order: confirm the correct trust type for your topology and that both forests/domains meet the functional-level requirements for that trust; verify cross-forest DNS so each side can locate the other’s DCs and global catalog servers; check time synchronization across all DCs (Kerberos will fail if clocks drift); and confirm the account used to create/validate the trust has the needed admin rights on both sides. Also check for any security templates or local policies that force NTLMv2-only or refuse older LM/NTLM traffic — bring both sides to a compatible setting for testing.

Run these simple checks on a domain controller in each forest:

nslookup -type=SRV _ldap._tcp.dc._msdcs.<otherDomain>
nltest /sc_query:<OtherDomain>
dcdiag /v
repadmin /showrepl

If SRV records fail, fix DNS before anything else. Verify firewall rules allow LDAP(389)/LDAPS(636), Kerberos(88), RPC(135) and SMB(445) plus GC ports (3268/3269) and RPC dynamic ports. Enable Netlogon debug logging and review the System, Security and Directory Service logs for authentication/secure-channel errors. If validation still fails, reset the secure channel or remove and re-create the trust only after confirming DNS, time, ports and policies are consistent. Capture the command outputs and Netlogon logs for troubleshooting if further help is needed.

Member Avatar for cutepinkbunnies

Hi Mai,

Ok...I'm trying to get this straight here.

1. You have both forests and domains at 2003 Server level
2. You are being denied trust creation based on credentials

Have you checked the security logs on the machines in question?
Sometimes if you configure stricter security settings (like my favorite template hisecws.inf) on one of the machines and not another, the box will reject all non-NTLMv2 traffic. So basically if you're using LANMAN or NTLM it would get denied.

I know this doesn't quite work the way NTLM is supposed to through negotiation, but I've created this issue in my labs a few times and has to do with the security policy of the machine in question.

This link talks about how things may be misconfigured.

http://kb.iu.edu/data/atcd.html

I hope this helps, if I misunderstood the question please let me know where I went wrong.

Jon

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.