Trusts over a WAN w/o servers present at remote sites

[bubarooni]

I have a three node WAN connected by Frame, lets call them Home, RemoteSite1, RemoteSite2. Each site has it's own subnet (Home- 192.168.1.x, RemoteSite1-192.168.2.x, RemoteSite2-192.168.3.x). Home has NT 4.0 servers acting as PDC, BDC's and an Exchange Server 5.5 SP4. DHCP is handled at Home by NT 4.0 and at the remotes by a Cisco 1750 router.

At the remote sites when I try to connect back across the frame to the Exchange server I always encounter a problem with permissions; something with not having permission to access the users mailbox. I think because the user has not been authenticated on the Home sites DC's.

I don't think the different subnets are going over well with the Home sites DC's. Can I setup a trust between the Home site and the Remote subnets some way even though the two remote sites don't have any servers to handle authentication or set trust? Even third party solutions would be welcome.

Any ideas?

 

[djhawthorn]

Well the first thing to find out is if the remote machines are logging into the domain. They will get a "Cannot find domain controller" error message when they log in if they aren't, or you can check the value for %LOGONSERVER% and see if it is the local machine (in which case they aren't logging onto the domain (or are using chached account information)), or onto one of the DCs.

Since the PCs are (presumably) a part of the domain, there is no need to setup any sort of trusts. Provided those PCs know how to get to the DCs and authenticate, then they should be able to access network resources. MCSE NT4/W2K

 

[bubarooni]

The PC's are definitely not logging on to the domain. Can I do this across the routers that seperate the remote site machines and the DC's?

They are set to workgroup currently since setting them to domain results in the "Cannot find domain controller" error message.

Do I need to enter a WINS server value or something in the HOST file?

Thanks

 

[djhawthorn]

Provided your routers aren't port-blocking, there is no reason they can't logon to the domain.

If you get "Cannot find domain controller" messages, then you either need to point those clients to a valid WINS Server, or edit/create an LMHOSTS file, so the machine can find where the domain controller(s) are.

A WINS Server reference would be much prefered over any LMHOSTS entires, as WINS is dynamic and entries are set once for all PCs, whereas LMHOSTS files are static, and set on each PC (large admin overhead).

Once you have setup domain-name to IP-address resolution (using one of the two above methods), rejoin then logon to the domain, and you should be able to access network resources.

Hope this helps. MCSE NT4/W2K