Couldn't verify trust domain relashionship between two-forest via Powershell\CMD

Question

Hi,

We've establish two-way trust relationship between two forest .
we've manage to validate trust in the "Active Directory Domain and Trust" tool, but when we trying to verify trust with "netdom" command we getting next message:

Does anyone know what cause this issue?

is there any other modern PowerShell tools for checking trust?

Answer 1

Hi,

Please use the /ud: parameter to specify the domain account that has domain administrator privileges.

{/ud: | /userd:}[<Domain>]<User>]

Specifies the user account to use to make the connection with the domain that you specify in the /d or /domain parameter. If you do not specify this parameter, then netdom trust uses the current user account.

/pd:{<Password>|*}

Specifies the password of the user account that you specify in the /ud or /userd: parameter. If you specify the value of this parameter as a wildcard character (*), this parameter prompts you for the password.

Please refer to this link for more details.
Netdom trust

Best Regards,
Ian Xue

-----------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello ArnoldMishaev

If access is denied for Netdom commands across a trust, you likely need to enable the Network access: Allow anonymous SID/Name translation group policy object on each domain controller.

The GPO is located in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Source - https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation

Other option is that your Domain Admin account which is running the command has no priviledges set into the other domain, in that case you should add the credential from Domain A into your domain controller of Domain B as Domain Admins group.

-----------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Hi @Ian Xue ,

Thanks for your respond,

I'm checking the trust from domain B, and it's still failed

Answer 4

Hi @Limitless Technology

Thanks for your respond,

I did enable the policy of "Network access: Allow anonymous SID/Name translation", on DCs on two forest.
and still same issue

and i also try to run the test with built-in Administrator user