November 21, 2018 at 8:23 am #608886
I have Parent Domain and Child Domain in my testing environment.
from Parent Domain, when I use parent\administrator account, I can access the Child DC server admin$
But I cannot access machines admin$ in the Child Domain other than DC server.
it asks me to insert credential, and it does not accept parent\administrator
in the Parent Domain, I have already added both Parent and Child administrator accounts in the Enterprise Admins group, and this Enterprise Admins is member of the Child Administrators group.
how can I solve this access issue?November 21, 2018 at 6:01 pm #608908
I’m not sure i quite understand what you’re trying to achieve here.
Is the PARENT\Administrator account a member of the Domain Admins group in the child domain?November 22, 2018 at 12:57 am #608918
Domain Admins group in the child domain is Global Type, I cannot add PARENT\Administrator directly there.
but in the Administrators Group (Built-in Domain Local Type) of Child domain, I have added PARENT\Administrator there.
Still did not solve the issue,
What I want to specifically achieve here is to make PARENT\Administrator and admin on all machines in the Child Domain(s), currently it is accepted as admin only on DCs machines.November 22, 2018 at 4:01 am #608921
Can you confirm that CHILD is a subdomain of PARENT (i.e. the FQDN is child.parent.com)?
Try adding the user to Enterprise Administrators in Parent as this should automatically make them domain admins in Child – not a long term solution, but allows you to check the automatic trusts are working.
vickynetParticipantNovember 23, 2018 at 5:49 am #608960
off course you can’t access the child domain resources because your are members of enterprise admin group, it has only access for all domain controller and child domain in forest wide but for resource you should have domain admin or GPO has to be enable for this resource access.
vicky.November 23, 2018 at 1:11 pm #608967
Thank you for your input, seems Enterprise Admin as you said it affects only DCs in the Forest.
so the question now, how to make Parent\Administrator account act as admin for the whole Forest?
I thought by adding it into Child Administrators group should be enough!!November 24, 2018 at 12:09 am #608973
You need to dd it to the Domain Admins group.November 25, 2018 at 7:21 pm #609015
Create a universal group and add the parent\administrator account to that then add the universal group to the Domain Admins group.November 27, 2018 at 4:48 pm #609301
It may be useful to get back to the basics and read about various AD-based groups and how they interact with each other.November 28, 2018 at 2:43 am #609347
Since danielp is “our” Daniel Petri, I assume it was directed at oudmaster.
Welcome back, Daniel – we’ve missed you – and how come your aren’t at least a moderator?November 28, 2018 at 5:31 am #609352
Strangest thing. You know how things are. Maybe you can tell whoever manages this to restore my status…
BTW, is there no way to send PMs now?
You must be logged in to reply to this topic.