Windows trust between parent and child domain broken

Romar 86

Hello,

I was wondering if anyone has an idea how a domain trust could be fixed.

The domain trust is broken but I can't fix it because DNS doesn't work properly anymore.
DNS can't be fixed, because the domain trust is broken.

The DC in the parent domain can't contact the DC in the child domain to validate the trust.

Thanks in advance!

5 answers

Marcin Policht 12,320 Reputation points MVP

2024-04-28T10:14:36.47+00:00

You have to ensure that the DNS name resolution between the two domains is working first. DNS is not dependent on a trust being in place.

More at https://petri.com/configure-dns-enable-trust-two-active-directory-forests/

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Romar 86 Reputation points

2024-04-28T10:17:40.25+00:00

Thank you for your suggestion. I tried setting up conditional forwarding from the parent. I created a new conditional forwarder but it came with the error "The server with this IP address is not authoritative for the required zone". However the server I added is in the Name Servers tab of the zone.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Marcin Policht 12,320 Reputation points MVP

2024-04-28T11:19:48.4233333+00:00

Verify that the name of the domain you specified is correct.

If this doesn't work (as it should), use secondary zones instead

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Please sign in to rate this answer.
Romar 86 Reputation points

2024-04-28T12:24:46.69+00:00

I have to do some more digging. I created a secondary zone but I get the failure:

Marcin Policht 12,320 Reputation points MVP

2024-04-28T15:55:39.52+00:00

Start by running nslookup against the server hosting the target DNS zone from the domain controller where you're trying to set up forwarding/secondary zone. Make sure nslookup works first.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Romar 86 Reputation points

2024-04-28T19:15:23.98+00:00

nslookup fails unless I use a hosts file. Tomorrow a network engineer will check if the firewall is blocking traffic.

Marcin Policht 12,320 Reputation points MVP

2024-04-28T19:52:06+00:00

That's a likely cause of the problem. Any DNS issues are bound to result in AD failures

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Marcin Policht 12,320 Reputation points MVP

2024-04-28T20:48:27.1733333+00:00

Btw. considering that these are two domains in the same forest, depending on the size of your environment, it might make sense to configure DNS zones to use forest-wide replication scope (assuming you are using AD-integrated zones). Otherwise, use delegation - not forwarding (since this is parent/child domain/zone configuration).

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Romar 86 Reputation points

2024-04-29T13:38:52.6066667+00:00

I'm not sure if I'm phrasing this right.

There is a delegation of the child domain namespace in the parent domain.
the namespace parent.local has a greyed out zone child.

Can a delegation be removed and recreated?

Marcin Policht 12,320 Reputation points MVP

2024-04-29T16:47:05.4466667+00:00

Yep - there is

https://learn.microsoft.com/en-us/powershell/module/dnsserver/remove-dnsserverzonedelegation?view=windowsserver2022-ps

However, there should be no reason to do so unless you are actually decommissioning the child domain or changing the scope of the replication of the child domain zone to be forest-wide.

I'd suggest focusing on making sure that nslookup works as expected - this should resolve the AD-related issues

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Romar 86 Reputation points

2024-04-29T19:07:30.94+00:00

I've never seen such a DNS mess, it's a dog's breakfast no matter how I slice it.
So far I've tried AFAIK every possible DNS scenario (conditional forwarders, Secondary Zones, Delegated Zones and Stub Zones) to get hosts in the child domain resolved from the DCs in parent domain. No luck so far. And I don't get any feed back from the security team if a firewall is blocking anything.
When I use portquery.exe to query DNS it doesn't show any errors.
Sign in to comment
sam john 0 Reputation points

2024-04-29T18:36:50.9933333+00:00

Try to reestablish the trust relationship between the parent and child domain.
Please sign in to rate this answer.
Romar 86 Reputation points

2024-04-29T19:08:14.3566667+00:00

It gives an error that the child domain can't be found.
Sign in to comment
Jing Zhou 2,315 Reputation points Microsoft Vendor

2024-05-06T03:00:57.7833333+00:00

Hello,

Thank you for posting in Q&A forum.

To further reset the domain trust between parent and child domain,

Please kindly follow below steps:

1.At a command prompt, type the following command, and then press ENTER:

2.Reset the trust password by below command:

netdom trust parent domain name /domain:child domain name /resetOneSide /passwordT:password /userO:administrator /passwordO:*

3.When you run this command in the child domain, use the following command syntax:

netdom trust child domain name /domain:parent domain name /resetOneSide /passwordT:password /userO:administrator /passwordO:*

For further details please refer to below Microsoft Official Documentation:

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-reset-trust

To help other customers who may be facing the same issue, please don't forget to vote if the reply is helpful.

Best regards，

Jill Zhou
Please sign in to rate this answer.
Romar 86 Reputation points

2024-05-07T18:15:19.68+00:00

Hi,

I executed the commands you suggested.
However the message "The zone transfer was not executed. Refused" persists.
Zone transfers from the child domain to the parent domain still don't work.
Sign in to comment