Here is an interesting one,

Scenario:

We now have 2 domains on our network, lets call the original one DOMX and the new one DOMY. The 2 domains belong to different organisations so each have their own forest, file servers, exchange servers etc. Users on DOMY do however need to access resources on DOMX. All the PCs remain a member of DOMX, due to the number involved its would be a major hassle to switch them to DOMY.

What I have done.

Using AD domains and trusts I have setup a 2 way domain trust (not forest, that caused major problems with authentication). I have set the folder permissions on DOMX so that users on DOMY can access the required folders and this works fine.

What doesnt work.

When the users login to DOMY the login script configured for their user accounts, along with the group policy on this domain are both ignored, so they lose their internet settings, documents mapping etc. If I make the computer a member of DOMY then the policies and scripts are all OK, but they then cannot access the resources on DOMX despite the permissions that work fine when the computer is a member of the other domain.

I need to find a way to run a batch file at login on DOMY, whilst the computer remains a member of DOMX and get the group policy to work without changing the domain membership of the computers.

I think that makes sense Manny.

Correct me if I'm wrong: you're sitting on a DOMX PC (registered on DOMX). You log into the DOMY domain, so you're effectively using a DOMY user account from a DOMX machine. However, the DOMY user account may not have had the correct scripts copied over.

The 2-way trust only allows file shares and the like to be authenticated across domains. However, I don't think you can long onto the "other" domain but still use your "current domain" user account. The domain you log onto has to have a user account on that domain and the scripts have to be copied over.

Sorry if I sound patronising, don't mean to I had similar problems with the project I'm working on at the moment.

edit: what kind of 2-way trust did you create? A translative one or something else?

[Correct me if I'm wrong: you're sitting on a DOMX PC (registered on DOMX). You log into the DOMY domain, so you're effectively using a DOMY user account from a DOMX machine.

Thats about it.

However, the DOMY user account may not have had the correct scripts copied over.

The DOMY user account has different login script associated with it.

The 2-way trust only allows file shares and the like to be authenticated across domains. However, I don't think you can long onto the "other" domain but still use your "current domain" user account. The domain you log onto has to have a user account on that domain and the scripts have to be copied over.

Would it work if I named the login script on DOMY the same as DOMX.

The screenshot attached is from DOMX, the DOMY trusts are shown. (domain names removed).

It's not a question of name, it's a question of the actual file.

When the use logs on, any scripts are normally stored int he \\domainname\netlogon directory. Of course, in your case, your script you want to use is in \\DOMX\netlogon or wherever. You need to copy it to \\DOMY\netlogon or wherever. You can have multiple scripts (one for each domain or user) and as long as the script for a user on DOMX doesn't have the same title as a script on DOMY, then you can copy it over and it should work.

Depending on DNS priorities, you may have to put in the FQDN though to get to the share. For example, you have a "net use T: \\server-a\files" where server-a box is on the DOMX domain. Now you want to access it from DOMY, you mave have to add "net use T: \\server-a.DOMX.local\files" or something like that. Otherwise the name resolution on the netbios name alone may not work.