configuring trusts between an Windows NT4 domain and sevrer 2008 domain

hi guys,

i'm @ wits end trying configure trust between windows nt4 , windows server 2008 domains.

there 2 ms articles have followd advising different changes in default domain controllers gpo in 2008 domain , these follows:

i have set allow cryptography algorithms compatible windows nt 4.0 setting

and following gpo settings:
  network access: allow anonymous sid/name translation -   enabled
  network access: not allow anonymous enumeration of sam accounts -    disabled
  network access: not allow anonymous enumeration of sam accounts , shares -   disabled
  network access: let permissions apply anonymous users -   enabled
  network access: named pipes can accessed anonymously -   enabled
  network access: restrict anonymous access named pipes , shares -   disabled
  network security: lan manager authentication level -   "send ntlm response only"
  microsoft network client: digitally sign communications (always) -   disabled
  microsoft network client: digitally sign communications (if server agrees) -   enabled
  microsoft network server: digitally sign communications (always) -   disabled
  microsoft network server: digitally sign communications (if client agrees) -   enabled
  domain member: digitally encrypt or sign secure channel data (always) -   disabled
  domain member: digitally encrypt secure channel data (when possible)   - enabled
  domain member: digitally sign secure channel data (when possible) -   enabled
  domain member: require strong (windows 2000 or later) session key -   disabled

the 2008 domain trusts nt4 domain when trying sset nt4 side of trust error 'could not find domain controller domain'. can ping 2008 dc nt4 side , following shows in nt4 betbios cache:

              netbios remote cache name table
 
    name              type       host address    life [sec]
------------------------------------------------------------
2008-domain    <00>  group       0.0.0.0             175
2008-domain    <1c>  group       10.30.105.49        -1
2008-domain    <1b>  unique      10.30.105.49        -1
2008-dc        <03>  unique      10.30.105.49        -1
2008-dc        <00>  unique      10.30.105.49        -1
2008-dc        <20>  unique      10.30.105.49        -1

can hlep me out working?

thanks in advance

hi shadowman123,

i'm little confused i've read other people have sucessfully created nt4 trust. saying completly impossible nt4 domain trust 2008 domain?

sainath irp_mj_create - have 2 domains never upgraded 1 reason or another. we're consolodating domains , need migrate off of nt4 in interim need trusts between domains.

hi,

have configure on nt4 domain, ntlmv2 authentication (this can break existing trust using ntlmv1).
after installing sp4, perform following steps configure lm compatibility level on windows nt workstations , servers. make sure sp4 windows nt installed.

1. run registry editor (regedt32.exe).
2. from hkey_local_machine subtree, go following key:
   hkey_local_machine\system\currentcontrolset\control\lsa\
3. click add value on edit menu.
4. add following values:

         value name: lmcompatibilitylevel
           data type: reg_dword
           data:  5
     					

5. hkey_local_machine subtree, go following key:
   hkey_local_machine\system\currentcontrolset\control\lsa\msv1_0
6. click add value on edit menu.
7. add following values:

         value name: ntlmminclientsec
           data type: reg_dword
           data:  0 (default) or defined above
     
           value name: ntlmminserversec
           data type: reg_dword
           data:  0 (default) or defined above
     					

8. click ok , quit registry editor.
9. shut down , restart windows nt.

please read support article careful:
how disable lm authentication on windows nt4

on windows 2008 domain need modify group policy
configuring following policy setting: computer configuration\windows settings\security settings\local polices\security options\network security: lan manager authentication level selecting “send ntlmv2 response only\refuse lm & ntlm” option in policy setting.

please careful;
i’ve heard of administrators have implemented setting (a) older network appliances stop working since rely on ntlmv1 , can’t ntlmv2, , (b) integrated windows authentication can fail external users trying access sharepoint sites. there may other side effects environment, sure test if plan on making change on network.

---

certifications: mcsa 2003 mcse 2003

Windows Server  >  Windows Server General Forum