Windows Active Directory two way trust

Question

Hello Experts,

So if I have two different Windows Active Directory forest (Forest A and Forest B) and then configure a trust between them. If I extend Forest A to Azure (deploying additional domain controllers in Azure for Forest A and then setting up AD replication), can an Azure VM join and resolve to Forest B, if the Virtual Network DNS IP has been configured as the Forest A VM?

Answer 1

Hello anonymous user

Think of Azure as a separate Active Directory site. You can follow the instructions here: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal to establish site to site VPN connection between Azure and both A and B Forests. Make sure you have conditional forwarding or stub zone configured in DNS of Forest A so that the requests to resolve the FQDN of Forest B can be forwarded to the DCs in that forest. Since you already have forest trust between these forests, you must already have DNS configured with conditional forwarding or stub zone. Make sure the same is present on Azure DCs as well so that any VM trying to resolve FQDN of forest B, can be forwarded to appropriate DCs via the DNS servers in forest A.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.