Click here to get back home

Creating and verifying Domain trust programatically

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Creating and verifying Domain trust programatically Devesh Sarwate 07-05-2005
Posted by Devesh Sarwate on July 5, 2005, 7:09 pm
Please log in for more thread options
Hi All,
I need to implement the creation & verification of domain trusts
programatically. I am currently using the LSA APIs
(LsaQueryTrustedDomainInfoByName and LsaCreateTrustedDomainEx) for this
purpose.

In some cases I do not have the credentials for one of the domains to create
the trust. In this case I would want to first verify if the trust is already
in place between the two domains and if the trust is broken then I create
one side of trust myself and ask the administrator for the other domain to
create the other part of the trust.

The problem is that for using the Lsa APIs to get the existing trust I need
credentials for both the domains. Is there any way sueshot way of
programatically validating domain trusts between two domains without having
the credentials for one of the domains.

This ought to be possible as the Domains and trusts MMC snapin does just
this when I click on the validate button on trust properties page.

Can some one explain what the click on the validate button does internally.

Thanks
Devesh




Posted by Steven L Umbach on July 6, 2005, 1:13 am
Please log in for more thread options
I am not a programmer but possibly you could use the tool nltest to do what
you need. The links below explain more and may help point you in the right
direction. --- Steve

http://support.microsoft.com/?kbid=228477
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/ea7f8494-ee1e-4d99-b28f-8f2fd8a72df2.mspx
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/c694f7f1-e05a-474c-b02b-19a7575ed860.mspx

> Hi All,
> I need to implement the creation & verification of domain trusts
> programatically. I am currently using the LSA APIs
> (LsaQueryTrustedDomainInfoByName and LsaCreateTrustedDomainEx) for this
> purpose.
>
> In some cases I do not have the credentials for one of the domains to
> create the trust. In this case I would want to first verify if the trust
> is already in place between the two domains and if the trust is broken
> then I create one side of trust myself and ask the administrator for the
> other domain to create the other part of the trust.
>
> The problem is that for using the Lsa APIs to get the existing trust I
> need credentials for both the domains. Is there any way sueshot way of
> programatically validating domain trusts between two domains without
> having the credentials for one of the domains.
>
> This ought to be possible as the Domains and trusts MMC snapin does just
> this when I click on the validate button on trust properties page.
>
> Can some one explain what the click on the validate button does
> internally.
>
> Thanks
> Devesh
>




Posted by Steven L Umbach on July 6, 2005, 1:18 am
Please log in for more thread options
Oops. I almost forgot that netdom is another tools that may better serve
your needs in that you can use it to verify and establish trusts. See the
link below on netdom uses and syntax.. --- Steve

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/9f921edc-87f5-460e-89ee-9ca56ec1d096.mspx

>I am not a programmer but possibly you could use the tool nltest to do what
>you need. The links below explain more and may help point you in the right
>direction. --- Steve
>
> http://support.microsoft.com/?kbid=228477
>
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/ea7f8494-ee1e-4d99-b28f-8f2fd8a72df2.mspx
>
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/c694f7f1-e05a-474c-b02b-19a7575ed860.mspx
>
>> Hi All,
>> I need to implement the creation & verification of domain trusts
>> programatically. I am currently using the LSA APIs
>> (LsaQueryTrustedDomainInfoByName and LsaCreateTrustedDomainEx) for this
>> purpose.
>>
>> In some cases I do not have the credentials for one of the domains to
>> create the trust. In this case I would want to first verify if the trust
>> is already in place between the two domains and if the trust is broken
>> then I create one side of trust myself and ask the administrator for the
>> other domain to create the other part of the trust.
>>
>> The problem is that for using the Lsa APIs to get the existing trust I
>> need credentials for both the domains. Is there any way sueshot way of
>> programatically validating domain trusts between two domains without
>> having the credentials for one of the domains.
>>
>> This ought to be possible as the Domains and trusts MMC snapin does just
>> this when I click on the validate button on trust properties page.
>>
>> Can some one explain what the click on the validate button does
>> internally.
>>
>> Thanks
>> Devesh
>>
>
>




Similar ThreadsPosted
permissions across domain without trust? August 7, 2006, 4:04 pm
Creating domain trusts September 23, 2006, 2:12 am
plz help to creating a windows server 2003 domain member user April 7, 2007, 3:08 am
Problem verifying publisher January 29, 2007, 10:12 am
creat a domain trust between Windows 2000 server, it show error message:"PRC server is unavailable" July 3, 2006, 3:59 pm
Accessing Local Security Policy Programatically August 3, 2006, 11:35 am
Howto : programatically give NTAUTHORIRTY\Network Service account write permission on a directory August 4, 2005, 9:38 pm
Creating our own certificate February 12, 2006, 10:30 am
Creating Certificate December 16, 2006, 9:16 am
Question regarding Certificate Trust Lists November 20, 2007, 4:38 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap