Multiple domains on Windws XP machine

[rac504uk]

Hi,

short question, i have a windows xp pro laptop that is a member of a domain and i wondered if it is possible for a machine to be a member of 2 separate domains. This the result being at the log on screen you are presented with the option to log onto the local machine, domain1 and domain2. didn't want to go ahead without making sure.

Cheers

rac504uk

[GregE240]

Not possible, unless you have trust relationships between the domains.

[pdV6]

Join the machine to the new domain. Next time you log on they'll both be in the droplist.

Don't think it can actively be part of 2 domains at once, though.

[pdV6]

...as Greg says, if the 2 domains have trust relationships set up, you'll see both in Network Neighbourhood no matter which one you log on to.

[rac504uk]

cheers for the quick responses, great help.

[ErnestM]

If you do this make sure that each user account for each domain has administrator priveleges on the laptop. Otherwise you may have trouble copying files between the accounts due to security flags on the files.

ErnestM

[TonyToniTone]

Not sure how this would work if the domains were in different forrest's ie domains at two differnet companies as your machine (account)is assigned a unique identifier when it joined to a totaly seperate domain..

You wont need admin rights lol.. you should be able to logon to any domain within a forrest and access any resources that the admins have assigned you rights to..

Forrest trust are set up by default in AD..

[_DeeJay_]

TonyToniTone said:

Forrest trust are set up by default in AD..

Not true. They're only available in Windows 2003 native mode, and they're setup manually.

IIRC, there are 3rd party tools which will allow a machine to easily move between 2 domains without administrators needing to intervene.

Take a look at www.globesoft.com/mnm8_feature_tour.asp?rmID=mnm8_feature_tour. From the marketing info, it should deal with it.

Darren.


>> Edited by _DeeJay_ on Wednesday 9th November 09:49

[ErnestM]

I was speaking about admin rights for the Laptop (or at minimum - power user - when you set up the user. Otherwise you may have issues when you go to logon to the laptop using cached credentials and you want to move some files around from one user space to another...

ErnestM

[TonyToniTone]

_DeeJay_ said:

TonyToniTone said: Forrest trust are set up by default in AD.. Not true. They're only available in Windows 2003 native mode, and they're setup manually. IIRC, there are 3rd party tools which will allow a machine to easily move between 2 domains without administrators needing to intervene. Take a look at www.globesoft.com/mnm8_feature_tour.asp?rmID=mnm8_feature_tour. From the marketing info, it should deal with it. Darren.

I meant domain trusts within a forrest (otherwise I would have been condradicting myself saying "if the domains were in different forrest's"
http://support.microsoft.com/kb/q3109

re: moving machines, I assume you mean domains in seperate forrests as you wouldnt need to move them.. lol.

[_DeeJay_]

TonyToniTone said:

_DeeJay_ said: TonyToniTone said: Forrest trust are set up by default in AD.. Not true. They're only available in Windows 2003 native mode, and they're setup manually. IIRC, there are 3rd party tools which will allow a machine to easily move between 2 domains without administrators needing to intervene. Take a look at www.globesoft.com/mnm8_feature_tour.asp?rmID=mnm8_feature_tour. From the marketing info, it should deal with it. Darren. I meant domain trusts within a forrest (otherwise I would have been condradicting myself saying "if the domains were in different forrest's" http://support.microsoft.com/kb/q3109 re: moving machines, I assume you mean domains in seperate forrests as you wouldnt need to move them.. lol.

Sounds like I just misunderstood the terminology you used; Transitive domain trusts are established automatically within a forest, forest trusts are setup manually (and Forrest thinks life is like a box of chocolates ).

Anyway, the long and short of it is that:

1) You cannot put a machine in two domains at the same time
2) If your machine is a member of a domain which has a trust (by whatever means) to another domain then you can log into the machine as a user from either domain (permissions allowing)
3) You can workaround machine domain membership by logging into a machine as local or domain user then providing credentials manually for another untrusted domain.
4) If you want to log into a machine as a domain user from more than one untrusted/unrelated domains then there are software packages which will change domain membership of your machine without administrator intervention.

D