#176921 - 2007-06-12 01:16 PM
Re: Computer account in multiple domains
[Re: Arend_]
|
Richard H.
Administrator
Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
|
Having read up a little bit more I gotta agree with Arend.
It looks to be a restriction of how the Kerberos tickets are exchanged.
Found this interesting article:
http://www.microsoft.com/msj/0899/kerberos/kerberos.aspx
It's a bit old, but it includes this pertinent information (my highlights):
Kerberos also allows authentication between clients and servers in different domains, although the process is a bit more complex than what you've seen so far. To authenticate itself to any server application, no matter what domain that server is in, a user must acquire a ticket to that server. But only a KDC in the same domain as the target server can issue that ticket, since only it knows that server's password. If a user wants to authenticate herself to a server in a different domain, then she must request a ticket to that server from a KDC in the foreign domain. And as is always the case, requesting a ticket from a KDC requires presenting a TGT to that server. The fundamental problem is for the user to acquire a TGT to the KDC in the foreign domain. Once she has this, she can request and use a ticket to the target server in the normal way.
For this to be possible, the two domains must have a trust relationship between them. When a trust relationship is created between two Windows 2000 domains, a password is also created that is known only to those two domains. As is described next, this shared password can be used to encrypt a ticket that's passed between the two domains.
|
|
Top
|
|
|
|
|
#176934 - 2007-06-12 06:58 PM
Re: Computer account in multiple domains
[Re: Richard H.]
|
Gaven
Starting to like KiXtart
Registered: 2003-06-19
Posts: 103
Loc: Washinton DC, USA
|
I hear this guy can do it:
http://www.globesoft.com/
|
|
Top
|
|
|
|
|
#176940 - 2007-06-13 08:40 AM
Re: Computer account in multiple domains
[Re: Mart]
|
Arend_
MM club member
Registered: 2005-01-17
Posts: 1896
Loc: Hilversum, The Netherlands
|
Like I said before SBS 2003 doesn't allow the use of TS except for the admin using the /console session. However there is a simple way to circumvent this but you will end up only allowing 2 simultanious users (+ admin using /console). SBS 2003 is configured like this on purpose, MS offers SBS at a reasonable price with alot of features for a reason  What they won't do is sell you CAL's for the TS on SBS 2003. They will tell you to buy 2003 Standard and setup TS on that.
SBS 2003 does contain Routing and Remote Access though so you can set up VPN's between the two domains.
100% separated networks... basically only thing that needs to be different is the DHCP scope and domain name.
Also you can do a really cheap solution if only 1 person at a time needs to use TS, forward a port to a XP machine's 3389. So they logon to that machine instead.
|
|
Top
|
|
|
|
|
#176955 - 2007-06-13 04:13 PM
Re: Computer account in multiple domains
[Re: Mart]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
|
Just FYI..
A friend works in a small office - 6-7 users. All workstations are XP home, various configurations, shared network with 4 other companies, no server, really bad setup. I get indigestion just thinking about it.
Anyway, last summer, I took one of my lab servers - a dual P3 1.2 GHz w/ 4G RAM, loaded SBS 2003 standard, and then loaded MS Virtual Server (which is free). I created a virtual XP Pro instance, sysprepped it, and deployed 5 instances under virtual server. The external users, using any crappy pc/config, would make an RDP connection to the virtual XP system console.
The virtual systems were tightly controlled via GPO, and maintained via WSUS, central AV, and kix scripts. Performance was adequate (considering the low end workstations they were already using) but it proved that the concept would work for a small office system given adequate hardware. I'd probably be comfortable using a dual P4 2.6GHz or better system, and would likely invest in the Enterprise? version of SBS to leverage additional RAM.
Glenn
_________________________
Actually I am a Rocket Scientist! 
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 2220 anonymous users online.
|
|
|
The load will be on the DC witch is also acting as a mail server, print server and fileserver so the TS could be a lighter server then the DC is as long as there is enough power to serve a maximum of 5 simultaneous TS users. This might be an option. I'll do some investigating tomorrow and talk to my CEO when he's in the office on Thursday.
I've been doing a lot of searching today and all I got was no, cannot be done, no way, not possible, etc.., etc.. Although I also found the link Gaven posted. It might be worth a try. I'll download a trial and see if it works and how it works when I'm back at the office tomorrow but my money is on a TS session for all "foreign users" on the new network.
