I tried to create external forest domain using the below steps and seeing exception while I validate the trust from any of the domains.
I am trying to setup external trust between two active directory domains (domain1.demo.com called as DOMAIN1 on computer AD-RESOURCE) and (domain2.addemo.co.uk called as DOMAIN2 on computer WIN-7ABCDEFG). The expectation is to be: Domain-wide authentication, Non-Transitive, External, Outgoing only from the domain dtpad.addemo.co.uk
On the domain, DOMAIN2:
- Open Active Directory Domains and Trusts
- On the domain, Right click and open Trusts
- Click on Add Trust
- Provided the computer name: AD-RESOURCE, Still asked me to provide realm trust or domain name. So, I provided Domain name: DOMAIN1
- Trust with a Windows domain, Specified domain: DOMAIN1
- Select External Trust
- Select one way: Outgoing
- Create trust for the following: This domain only
- Scope of authentication for users from DOMAIN1: Domain-wide authentication
- Trust Password
- Ready to create the trust a. This domain: domain2.addemo.co.uk b. Specified domain: DOMAIN1 c. Direction: Outgoing: Users in the specified domain can authenticate in the local domain d. Trust Type: External e. Transitive: No f. Outgoing trust authentication level: Domain-wide authentication g. Sides of trust: Create the trust for this domain only
- Next – Trust relationship created successfully
- Do you want to confirm the outgoing trust? – Yes, confirm the outgoing trust
- Completing the New Trust Wizard You have successfully completed the new trust wizard, but the newly created relationship cannot be confirmed for the following reasons: i. The verification of outgoing trust failed with the following errors: The trust password verification failed with error 1787: The security database on the server does not have a computer account for this workstation trust relationship.Before this trust can function, it must also be created in the other domain. Ensure the same trust password is used in both domains.
I am trying to execute the above steps as Domain Admin.
Regards, Tejo.
