DP in different forest

Question

we have 2 forest, one for prod and other for DMZ. Prod servers (abc.com) and DMZ servers (xyz.com) are domain joined.
Primary server is (PRI.abc.com) We want to use SCCM to patch servers now so for 150 servers in DMZ i was thinking to just put a DP in DMZ forest (DMZDP.xyz.com)
Is the solution sounds fine in terms of roles.
Also, its just like putting any other DP in same forest after opening ports or do i need to do anything additional to set up DP in DMZ?

Answer 1

Hi @Karun Khanna ,

We could just configure some ports between untrusted forests.

Please refer to the following picture:

And about the detailed information, kindly refer to this article:
https://systemcenterdudes.com/installing-sccm-dp-mp-sup-untrusted-domain/
Note: This is non-official Microsoft article just for your reference.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Clients must also be able to connect to an MP and a SUP. Without knowing more details of the environment and your network's security policies, not much can really be said here except that the AD domain scenario is completely irrelevant for designing the proper solution here.