Hi,
in organization two domain with two way trust qwe.com and zxc.com. I add two new domain controllers to zxc.com and have a problem.
When I add user from qwe.com to group of zxc.com, and after that try to show members.
On new domain controller I cam see this
![]()
![]()
and on old domain controllers - ok
From new domain controller I can search users from qwe.com directory. In ForeignSecurityPrincipals OU (on new domain controller) I can see objects like SID and can not see there attributes. On the old controller, I can see the objects and their properties.
BPA error is:
Title:
Domain controller DC02.zxc.com must have "Access this Computer from the Network" granted to the appropriate security principals
Severity
Error
Problem:
Domain Controller DC02.zxc.com does not have user right "Access this computer from the network" granted to 'Builtin Administrators', 'Enterprise Domain Controllers' or 'Authenticated Users', or has the user right "Deny access to this computer
from the network" assigned to either of those groups or 'Everyone'.
Impact:
Replication operations initiated by other domain controllers in the domain or by administrators may fail. Users and computers may also experience failure to apply Group Policy objects.
Resolution
Verify that the domain controllers in the domain zxc.com have this user right granted to the appropriate security principals. Using Group Policy Management and Group Policy Results, verify that the winning Group Policy for the "Access this computer from
the network" user right grants that right to the 'Builtin Administrators', 'Enterprise Domain Controllers', and 'Authenticated Users' groups. Verify that the policy setting "Deny access to this computer from the network" does not have 'Everyone',
'Authenticated Users', 'Builtin Administrators' or 'Enterprise Domain Controllers' groups defined in it.
http://go.microsoft.com/fwlink/?LinkId=168844
I check policy, and all permission are default.
Title:
Domain controller DC02.zxc.com must have "Enable computer and user accounts to be trusted for delegation" granted to the Builtin Administrators security group
Problem:
Domain controller DC02.zxc.com must have the "Enable computer and user accounts to be trusted for delegation" user right granted to the Builtin Administrators security group if domain controller DC02.zxc.com is used as a replication partner during
a domain controller promotion.
Impact:
Installation of additional domain controllers (promoting replica domain controllers) in domain zxc.com may fail if they select domain controller DC02.zxc.com as a replication partner during the installation.
Resolution
Verify that the current domain controllers in domainzxc.com have the "Enable computer and users accounts to be trusted for delegation" user right granted to the Builtin Administrators group
http://go.microsoft.com/fwlink/?LinkId=168842
Title:
SID filtering is not enabled for external trust qwe.com
Problem:
SID filtering is not enabled for external trust qwe.com established with domain zxc.com
Impact:
If authentication occurs across an external trust boundary (where the user and the computer hosting the resource are in different domains), a vulnerability exists because domain zxc.com (the trusting domain) does not verify that the trusted domain qwe.com is
actually authoritative for all the SIDs in the authorization data (that is, the access token). It is possible for an attacker or rogue administrator to insert SIDs into the authorization data presented to this trusting domain zxc.com.
Resolution
Enable SID filtering for external trust qwe.com by using the netdom trust /quarantine:yes command. Enabling SID filtering may prevent users from accessing resources in your environment. Before enabling SID filtering for the trust, you should review the detailed
resolution procedures for this BPA rule.
http://go.microsoft.com/fwlink/?LinkId=168864