Member Avatar for uniquestar

Hi All,

I have been asked to put a Domain Trust in place between a couple of sites, but due to the setup of the domains, I am a bit concerned if it will work correctly, or mess up both domains, so looking at a bit of advice as to if this will work or not.

Please see below a quick overview of our netowrk setup, and let me know if you need any further info:

Domain 1: contoso.london.local. PDC (2008 R2) connected via VPN to secondary domain controller (2003) for contoso.london.local. (This relationship is already in place and working correctly).

Domain 2: contoso.local. PDC (2003).

The only VPN link between the 2 domains is currently between the Domain 2 PDC and Domain 1 SDC.

I guess my question really is is it possible to put the trust relationship in from Domain2-PDC to Domain1-SDC, with my bigger worry being that the first part of both domains is named the same.

Any input is appreciated!

Thanks,

  • 2 Contributors
  • 2 Replies
  • 120 Views
  • 45 Minutes Discussion Span
  • Latest Post Latest Post by JorgeM

Dani AI

Generated

Both and are on target: identical flat (NetBIOS) names plus overlapping DNS suffixes cause real problems for trusts and name routing. NetBIOS is still used by legacy resolution and some cross-domain lookups, so a duplicate NetBIOS name will produce collisions and prevent a clean cross-forest trust. Overlapping DNS namespaces adds DNS routing ambiguity on top of that.

Recommended checks before any further planning:

  • Confirm each domain's NetBIOS name and DNS root (Active Directory PowerShell module required):
    Import-Module ActiveDirectory
Get-ADDomain -Identity "<domainFQDN>" | Select-Object NetBIOSName, DNSRoot
  • Verify cross-site DNS resolution and that conditional forwarding or stub zones are in place for the other forest.
  • Use nltest /dsgetdc:<domainFQDN> to confirm DC reachability from the other site.

Practical options if a trust is required:

  • Rename a domain’s NetBIOS/DNS names only if feasible and well planned (domain rename is complex and risky; test in a lab). This is generally only possible inside the same forest via the domain-rename process.
  • Migrate objects into a single, uniquely named forest/domain using ADMT (recommended for long-term consolidation).
  • Rebuild one domain with a unique name (often the simplest for small environments).
  • If renaming/migration isn’t possible, avoid a traditional domain trust and use alternatives such as federation (AD FS/Azure AD), application-level trusts, or explicit resource-account solutions.

Cautions and planning notes:

  • Domain rename and migrations require full backups, extensive testing, and downtime windows.
  • DNS conditional forwarders or stub zones mitigate name resolution but do not resolve NetBIOS collisions for trust creation.
  • A lab reproduction of the topology and a staged migration plan will reduce surprises.

This summary builds on ’s discovery and ’s note about suffix routing; the safest paths are either to make the two domain trees uniquely named or to consolidate resources rather than forcing a trust across identical NetBIOS names.

Recommended Answers

All 2 Replies

Member Avatar for uniquestar

Don't worry, I have found the answer that this is not possible due to the NETBIOS domain showing as exactly the same.

Member Avatar for JorgeM

Aside from the NetBIOS name, domains form different Active Directory forests that share the same namespace will have domain suffix routing issues.

So, setting up a trust is not a good idea for this type of scenario.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.