More on Netdom 2000

Learn how to trust

In the November 1999 This Old Resource Kit, I explained how to use Windows 2000's (Win2K's) Netdom for a specific task—moving machine accounts from a resource domain to a master domain's organizational unit (OU). That task took up all the space in the column, but I've since learned more about Netdom that I want to share with you.

In case you haven't read the November issue yet, Netdom is a powerful Microsoft Windows 2000 Resource Kit tool that lets you create, destroy, and monitor trust relationships; add machines to a domain; remove machines from a domain; and synchronize system times. That kind of command-line power is great, except for one caveat: Netdom is a nightmare of command-line options and idiosyncrasies. Here, then, is Netdom simplified.

Netdom's syntax is

netdom 

where the possible commands are Add, Join, Move, Remove, Reset, Verify, Trust, Query, and Time. For information about these commands' functions, see the resource kit's Netdom Help files. In this column, I focus on the Trust command.

In general, when you join two components (i.e., create a trust relationship between two domains or join a machine to a domain), one of those components needs to recognize you as an administrator. Netdom arbitrarily calls one component the object and the other the domain. As I explained in the November column, you use the /uo: and /po: options to inform Netdom of the account name and password of an account that the object recognizes as an administrative account. You do the same for the domain with the /ud: and /pd: options. When you join (or disconnect) a machine to a domain, the machine is the object and the domain is the domain. However, when you set up a trust relationship in which a trusting domain will trust a trusted domain, then the trusting domain becomes the object and the trusted domain becomes the domain. Thus, you'd use the /uo: and /po: options to specify the administrative account for the trusting domain, and you'd use the /ud: and /pd: options to specify the trusted domain's administrator.

In the same way, you name the domain with the /d: option and follow the /d: parameter with the object's name. Therefore,

netdom trust /d:B.com A.com ...

starts off the command to make domain A.com trust domain B.com.

You create a trust relationship by adding the /add option. Suppose you want domain A.com to trust domain B.com. The Netdom command would look like

netdom trust /d:B.com A.com /add /uo:[email protected] /po:pwa/ud:[email protected] /pd:pwb /verbose

where A.com's administrator is admina and B.com's is adminb, with passwords pwa and pwb, respectively. I always use the /verbose option. Building a Netdom command can be complex, and /verbose helps me figure out where I made a mistake if Netdom doesn't work.

You can build two-way trusts by adding the optional /twoway command. In this case, the object and domain classifications don't matter:

netdom trust /d:B.com A.com /add /uo:[email protected] /po:pwa/ud:[email protected] /pd:pwb /verbose /twoway

You break a trust relationship by replacing /add with /remove. If you've created a two-way trust, you need to include the /twoway option when you break the trust, as this example shows:

netdom trust /d:B.com A.com /remove /uo:[email protected] /po:pwa/ud:[email protected] /pd:pwb /verbose /twoway

I'm out of space again. In case I don't get a chance to revisit Netdom, look up the /verify and /reset commands, which are useful in monitoring trust relationships. Win2K will help reduce the number of trust relationships in an enterprise, but as long as trusts are necessary, Netdom is invaluable.