new trust wizard "cannot continue"

Forums › IT Pro and developers › new trust wizard "cannot continue"

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#105283 1-Jul-2012 09:54

attempting to setup a lab with a one way trust. Each segment has operational domains. They are connected via two way route rule on the router for all ports. Each of the DCs can ping one another but the wizard stops with a very uninformative "cannot continue". I've reviewed the windows events and nothing is recorded there, I was wondering if there is a log file somewhere I can review?

both domains are 2008. both have forward and reverse DNS entries for each other. Based on the Microsoft article conditional forwarders are not used for 2008.

amanzi

Amanzi
1275 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#649016 1-Jul-2012 13:12

Try using the Portqry.exe tool (or PortqryUI.exe) to verify that all required ports are open - it will also test LDAP connectivity.

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#649050 1-Jul-2012 14:03

Queries returned success with the expected LDAP details being returned. I wonder if there is an outbound or inbound rule that is not normally needed for internal domain controllers that I need to open to initiate the trust?MS material doesn't state that any additional networking is needed, but you never know.

My gut tells me there is a DNS trick I don't know about. The MS material says the DNS is important, but for disconnected DNS servers in Server 2008 it indicates no additional DNS changes need to be made?

edit: kerberos is returning 0x00000002 which I ignored as I'm not using Kerberos, but then noticed 138 and 42 are also retuning 0x00000002, more research me thinks...

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#649058 1-Jul-2012 14:20

Turned the windows firewalls off at both ends and no change, so I don't think it's network

dan

1134 posts

Uber Geek

Lifetime subscriber

#649069 1-Jul-2012 14:41

have u made sure both domains can resolve either other correctly dns wise? if you nslookup the second domain from the first, and vise versa. does it resolve correctly? if not, but you can ping it etc, id add it manually into the hosts file and retry..

its usually the simple things like this really

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#649074 1-Jul-2012 14:52

nslookup resolves source and target domain root from both sides of planned trust. i've added forward and reverse lookup zones both segments on both domains DNS.

dan

1134 posts

Uber Geek

Lifetime subscriber

#649076 1-Jul-2012 14:55

does it resolve the full name of the domain controller as well, i.e machinename.domain.local as well as domain.local ?

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#649081 1-Jul-2012 15:13

it didn't, so i've added the dns entries on both sides to they do, but still not progress. The wizard is so frustrating as you have to restart the wizard each time to test.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#649083 1-Jul-2012 15:17

ran DCDIAG and all passed, that's it for today, burned 6 hours on this, I'll have another go next weekend.

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#649311 1-Jul-2012 23:53

And does DomainDnsZones.domain.local resolve on both sides too? I've discovered trying to investigate issues with Java apps trying to authenticate against AD that LDAP lookups are referred to this DNS name for the actual LDAP query.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#743147 11-Jan-2013 09:45

Kyanar: And does DomainDnsZones.domain.local resolve on both sides too? I've discovered trying to investigate issues with Java apps trying to authenticate against AD that LDAP lookups are referred to this DNS name for the actual LDAP query.

I've added DomainDnsZones to the DNS of both domains (resolving to the domain controller of each domain), but still not recognised on either side.

lyonrouge

1993 posts

Uber Geek

Trusted

Lifetime subscriber

#743205 11-Jan-2013 11:01

Answer : change the AD DNS zone to "Stub Zone" and now one-way trust has been established.