0

I am in the situation that has multiple forests and some DFS shares (replicated in one domian at the moment) should be consolidated so that they are usable by all domains.

Concrete: We have domains A B and Z, each in their own firests. Z is an operational core, so A and B have trust with Z (both directions).

A and B have a DFS tree that is used internally, as has Z.

A and B AND Z have something they share which is a number of folders that are part of their DFS namespace and replicated to multiple folders. THis is for example a image and a software folder containing softrware for intallations and a large number of ISO files for the administrators to use. Or a large (read only) data archive (terabyte range) that then could be accessed by all domains "attached to" Z.

I would love to move that to Z - and somehow integrate it into a DFS hierarchy in A and B so that...

in A if you go to A.domain\dfs\Software the content comes from either file shares on Z or a DFS folder in Z (Z.domain\dfs\Software). Note that at no poin is cross forest replication needed. This would allow A and B to see the folder in their DFS hierarchy, while maintaining a central repository at Z.

How can I set this up? Documentation is sparse, it seems. Not even sure this is possible.

TomTom
  • 51,649
  • 7
  • 54
  • 136
  • For others who would ask this old but relevant question: please clarify the exact final setup that you want. You might want to put the root namespace in forest Z, keep existing namespaces in forests A and B, and put links to them within the DFS namespace in forest Z. Or you might fully consolidate them all into one DFS configuration in forest Z. The solutions to each would be different. – SamErde Jun 30 '21 at 12:56
  • I fail to understand the question too. A DFS namespace is simply a collection of pointers to shared folders which may reside anywhere; what exactly stops you from pointing a DFS folder to a SMB path in a different forest? As long as the forest trust is in place and the user has proper access rights, accessing it should be completely transparent. – Massimo Oct 28 '21 at 19:24

1 Answers1

0

As DFS uses AD to store its config and uses Kerberos for authentication, I would say that it's not possible.

Trondh
  • 4,201
  • 24
  • 27