Hi Guys,

 I have a problem recently where we have two domains, each on different subnets that we're trying to allow people to connect across on. Users on DOMAIN A need access to resources on DOMAIN B. We figured that we'd create temporary accounts with access to the files on the DOMAIN B side so that when a user attempts to access a resource on DOMAIN A they would be prompted for credentials and if they put in their DOMAIN B credentials, they could access what they need to. However when some of our DOMAIN A users attempt to do this, instead of getting a prompt like some users do, they're given an error saying their account on DOMAIN B has been locked out and can't access the resource.

When I log onto the DC on DOMAIN B and check, sure enough their account on that side has been locked out.

Any ideas on how I can make this work?

The client workstations trying to connect to the resource are Windows 2000 machines, on a Windows 2000 mixed domain (DOMAIN A) connecting to a Windows Server 2003 R2 File/Print/Directory server (DOMAIN B, Windows Server 2003).

OH yeah, these Domains are in different FORESTS. 

Thanks,

 Dave


 

Do you have trust between the two domains?  If not you can easily setup them up and just drop the groups in from the different domains for the access to resources. If you need help setting up the trust between the two domains let me know and I can find the steps for you.

I had issues in the past where the accounts are getting locked out, because the SID that is associated with the account in one Domain is Different then the other Domain Account SID.  It locks the account out right away because the Domain thinks the account is Hacked. 

 Hope this helps and keep us up to date about your results.

 LZ-KID OUT
 

Thanks guys,

 Those were the answers I needed.

- Dave