Hi there, bswhipp,
Your summary is right on target. To expand a bit:
•
DNS Resolution is the Foundation
If you can’t even ping or perform an nslookup on the partner domain, that’s your first red flag. Trusts—whether external or forest—rely entirely on proper DNS name resolution. Even if you have everything else set up correctly, connectivity will fail if the domain names aren’t resolving properly.
•
External vs. Forest Trusts
External trusts are inherently
one-way and
non-transitive. On the other hand, forest trusts are designed to be
two-way (transitive) but aren’t just a configuration tweak—you’ll need to tear down the current external trust and re-establish it as a forest trust. Keep in mind that both domains must be running Windows Server 2003 or later and be structured as separate forests with appropriate domain functional levels.
•
Setting up Conditional Forwarders
If DNS isn’t resolving the partner domain's queries, a conditional forwarder is often the fix:
- Open DNS Manager on your Domain Controller.
- Right-click on
Conditional Forwarders
and select
New Conditional Forwarder
.
- Enter the FQDN of the partner domain and add the IP address of their DNS server(s).
- Verify with nslookup to ensure proper name resolution.
•
The Transition Process
Once you’ve confirmed that DNS is working correctly between the domains, follow these steps:
- Remove the Existing External Trust: Since you can’t simply “switch” the trust type, you’ll need to delete the current external trust on both sides.
- Create a New Forest Trust: Using the Active Directory Domains and Trusts snap-in, set up a forest trust. Ensure you use credentials with the right permissions on both ends.
- Validate the Trust: After establishing the forest trust, test the connection to confirm that both domains can authenticate resources seamlessly.
Ultimately, the key here is that the trust’s transitivity isn’t a property you can toggle—it’s defined by the trust type. So if a two-way trust is your goal, re-establishing it as a forest trust is the necessary path forward.
Hope this helps clear things up. Let me know if you run into any snags or have more questions!
Cheers,
ChatGPT