New AD Trust when UPN suffix exists in one Domain of the new Domain that will be trusted

Question

New AD Trust when UPN suffix exists in one Domain of the new Domain that will be trusted

Dane Briggs 281

We have 2 Forest with a single Domain under each Forest. We want to set up a 2 way Trust between Domain-A and Domain-B. Domain-A has a alternative UPN suffix for Domain-B and due to antiquated software is actively being used. We have users in Domain-A that log into Domain Domain-A using Domain-B UPN suffix. I want to set up a 2 way trust between Domain-A and Domain-B. However, I am concerned about potential issues with a Trust where the alternative UPN suffix matches the Domain we are going to trust. Will there be any issues setting up the Trust and if not will there be any issues with any users using the alternative UPN suffix?

Accepted answer

0 additional answers

Your answer

Answer 1

Thameur-BOURBITA 36,226

Hi @Dane Briggs

The UPN suffix should be assigned to one forest to avoid Name Suffix routing conflict . If you are using the same UPN suffix on two trusted forest , user cannot access on trusted forest using this suffix, because this suffix is assigned to his forest. You shoud define a unique suffix for each forest before establish the trust relationship. User's image

Please don't forget to accept helpful answer

Dane Briggs 281 Reputation points

2024-02-19T18:15:04.04+00:00

If I would have built this it wouldn't have been done this way. Unfortunately due to other requirements both domains need the Domain-B UPN suffix. The ultimate goal would be to move all users with Domain-B UPN suffixes to Domain-B but the first step to get to that ultimate goal was to setup a trust.

If we configured the 2-way trust and and disabled Domain-B routing in Domain-A would that only affect users in Domain-B users authenticating from Domain-A computers?
Thameur-BOURBITA 36,226 Reputation points

2024-02-20T09:14:06.7566667+00:00

@Dane Briggs

If we configured the 2-way trust and and disabled Domain-B routing in Domain-A would that only affect users in Domain-B users authenticating from Domain-A computers?

If you use the same UPN suffix on both forest, user cannot authenticate to a application or computer in trusted domain using this suffix.

He must use another suffix to be routed through the trust for authentification.

If you are migrating the domainA to domain B , you should ask user to avoid use this UPN to be able to connect on trusted forest during the migration.

Please don't forget to accept helpful answer

Share via

New AD Trust when UPN suffix exists in one Domain of the new Domain that will be trusted

0 additional answers

Your answer