In a 1 way trust domain server, Users can login the server but not run services with their account?

Question

In a 1 way trust domain server, Users can login the server but not run services with their account?

Jean-Valentin 6

Hey all.

I need your help on this topic please.

I configured a 1 way trust between two Domain, A is the trusted Domain and B trust A.

Users from Domain A can login to the servers in domain B. No problem at all, I even added them by groups populating domain local groups on Domain B.

But the issue is if they want to configure a service on a Domain B server using their domain A account, the acount is well retreived but can't be applied with an access denied error.

I tested to add their Domain A account directly on the local admin group of the Domain B servers and also granted them full access on the folder containing the service. Nothing works, I receive error denied.

2 way trust was perfectly working.

I miss something about services and 1 way trust but I don't know what.

If someone could please help me to understand why my trusted users perfectly can connect the Domain B server but can't configure services with their account, it would be nice.

Thanks in advance.

Regards

1 answer

Your answer

Answer 1

Yanhong Liu 14,200 Microsoft External Staff

Hello

Thank you for posting in Q&A forum

If you can success using A domain account login to B domain , it means that your domain set is correct .

But still they say access denied . so can you test to add this A domain trust account into B domain enterprise admin group to see if it can work (enterprise admin means in the forest range)

If it can work, you can try to add it to domain admin , or local admin limit the right range.

How trusts work for Microsoft Entra Domain Services - Microsoft Entra ID | Microsoft Learn

Best regards

Yanhong

=====================================

If the answer is helpful, please click "Accept answer" and upvote it

Jean-Valentin 6 Reputation points

2024-08-28T09:19:19.55+00:00

Hi Yanhong Liu,

Thanks for answering.

The pb is in enterprise admin group or domain admin group you could add only account from your domain, not from a trusted domain (Or I don't know how to do and can't find document talking about this!) even if you add the trusted user to a domain local group, you can't use domain local group to populate them.

If the account is created on domain A and configure the service on the server in Domain B while the 2 way trust is in place, all is fine.

If the account is created on domain A and configure the service on the server in Domain B while the 1 way trust is in place, I receive the access denied error even if I'm perfectly able to login the Domain B server with the Domain A trusted account. (This account is already added in administrator local group of the domain B server)

So thinking about your idea, I tried to add my trusted account to the builtin\administrators group on domain B. Then I forced my replication between DC to be sure.

(Get-ADDomainController -Filter *).Name | Foreach-Object {repadmin /syncall $_ (Get-ADDomain).DistinguishedName /e /A | Out-Null}; Start-Sleep 10; Get-ADReplicationPartnerMetadata -Target "$env:userdnsdomain" -Scope Domain | Select-Object Server, LastReplicationSuccess

And this seems it was the solution at first glance, on my test account because it work once.But trying to create a second test account and reproducing the same conditions, it was not working again!

This thing makes me crazy.

PS : I know this documentation, but can't find on it what could be different on service logon authentication than server login authentication.
Jean-Valentin 6 Reputation points

2024-08-28T09:50:22.09+00:00

More and more strange, with the 1 way configured, I create a 3rd test account on A, then directly add it to local admin group on B server without doing anything else and directly configure the service on B server with the A account, it works.

I tried to modify the service again with the previous 2nd test account which was having the error message : access denied error for more than an hour trying to add it to all different groups in my B Domain and now it works!

This is crazy, I can't understand what I miss.

I modified this post as today 29/08 is a new day and the issue restart. Unallowed to launch any services on B domain Server with trusted account for Domain A even if we're perfectly able to login them. The only thing happens is the servers are forced shutdown by Vmware on the evening. I'm wondering what this force reboot could break or remove which forbid the services access. I'll do a workaround creating a gMSA on B domain and configures it on each services of the impacted server, but that's not normal and I've no more idea what is the root cause.
Jean-Valentin 6 Reputation points

2024-08-29T12:13:56.7733333+00:00

New day, the issues still occurs. Like yesterday, we're again not able to launch any services with the trusted account on Domain B even if we're allowed to connect the servers. The only thing happen is the server reboot every day forced by VMWare. I'm wondering if something could be link to the reboot. I reenabled the 2 way trust and it fixed it. I'll do a workaround creating a gMsa in the B domain to launch these services but there is something I can't explain.
Jerry-Lenon 0 Reputation points

2025-03-05T09:24:04.0066667+00:00

Hey @Jean-Valentin , I have EXACTLY the same scenario/issue as you have, with same outcome - it is driving me crazy. Were you able to fix this up somehow? / I am able to log in using this account, assign it to the folders, and grant local admin rights, but I am getting Access denied when trying to run the service as this user.

Thank you very much for any insights in this matter.
Jean-Valentin 6 Reputation points

2025-03-05T09:39:46.2766667+00:00

Hello Jerry-Lenon,

No I never found the reason of this strange behaviour in a 1 way trust and if I remember, never found documentation about it on Microsoft website. But I also never opened them a support ticket for this. Sorry !

In my configuration, the workaround I used was to create a gMsa in the B domain to launch these services. It was enough for us.

If you finally find the answer, don't hesitate to add to this post.

Good Luck.
Jean-Valentin 6 Reputation points

2025-03-05T09:47:25.0866667+00:00

Sorry, it's in double, I thought, the first answer wasn't saved.

Share via

In a 1 way trust domain server, Users can login the server but not run services with their account?

1 answer

Your answer