Re: Win2k and one-way trusts

From: Steven Umbach (n9zrou_at_nscomcast.com)
Date: 01/24/04 

Date: Sat, 24 Jan 2004 22:38:59 GMT

I have never tried that but a couple thoughts. You can create one way explicit
trusts if the domains are in different forests. Having different domains will
allow different account policies. If you decide to not use a second domain, you
can further harden the domain machines in the dmz by adding the administrators
group to the deny access to this computer from the network for administrators
and log onto it locally to manage it or temporarily change the policy. Passprop
can also be used to enable the administrator account to be locked out from
network logon which should also be renamed. Disable file and print sharing and
other unnecessary services on it and make sure that number of logons to cache is
set to zero in Local Security Policy effective settings. Changing some security
options on it such as changing additional restrictions to anonymous connections
to no access without explicit anonymous connections [if it does not cause
problems with authorized clients], setting digitally sign communications
client/server to always, changing lan manager authentication level to use ntlmv2
only refuse lm and ntlm, and removing the users/everyone group from access the
computer from the network and replacing it with authenticated users [a user
right assignment]. Most of those security options would be applied by
importing the highsecws.inf template with the exception of cached logons.
Depending on the machines in your domain, some of those changes may cause
problems with domain machines, particularly if you have W9X or NT4.0 machines.
Of course enabling auditing and monitoring security log is a good idea. ---
Steve

http://support.microsoft.com/default.aspx?kbid=309689
http://www.jsiinc.com/SUBI/tip4300/rh4315.htm

"LCI" <it@lcitoys.com.DeleteThis> wrote in message
news:ehf4jQc4DHA.2188@TK2MSFTNGP10.phx.gbl...
> I need to the ability to authenticate domain users in my DMZ, and I am
> not overly thrilled with the idea of an internet facing system having
> direct access into the domain if I can avoid it. So I was thinking about
> building a small domain in the DMZ and setting up a one way trust
> between my primary domain and it. (dmz trusts the domain, the domain
> does not trust the dmz). That way I can setup the DMZ domain controller
> in the DMZ but not make in publicly accessable and I don't mind opening
> up ports like 135 if I have to. Does anyone have any experience doing
> anything like this or have a better suggestion? I realize that my
> one-way trust concept is somewhat rooted in NT4 but I haven't yet
> figured out the AD terminology/techniques that I need, os any help there
> would be great as well. TIA.
>
> --Jared
>

Relevant Pages

  • Re: Forest Trust between Production & DMZ
    ... >> more vulnerable, external, then we are speaking of the trust ... If your DMZ gets whacked, ... To avoid the Swiss-cheese affect on the firewall, ... > Network segregation was a good thing at times when Internet Protocol was ...
    (microsoft.public.windows.server.security)
  • Re: Access denied on network share in an other domain
    ... Leaving aside the idea of the Trust for a moment, the idea is that hosts in the DMZ should have no or limited access to the LAN. ... It sounds as though what you would do is to copy out your data from the internal network to the DMZ. ... The copy needs to use credentials that the DMZ recognises, e.g a local account on the DMZ server, or else you can use a one way trust where DMZ servers trust internal server. ...
    (microsoft.public.windows.server.security)
  • Re: HIPAA and DMZ
    ... auditors seem to think otherwise and they even stipulate using DMZ ... > Here is the problem I am facing with a trust. ... > Once a file gets populated in that shared folder the DTS package will run ... >>> partners connect to Internet appas, ...
    (microsoft.public.security)
  • RE: Active Directory and IIS on production servers, and clustering
    ... > the Microsoft-supported position (DB in the secured network ... DMZ, it makes sense to have a DMZ domain just in order to be able to easily ... cases, unless there is some pressing business need to make a trust, I would ... WRT putting IIS and a DC together, back in IIS 5.0 days, yes, that was a ...
    (Focus-Microsoft)
  • Re: AD Services in the DMZ
    ... I've heard of some down-sides to a one-way trust from our main acct. ... These will likely reside in our DMZ forrest, ... but I'm leary of app remediation. ... the internal forest ...
    (microsoft.public.windows.server.active_directory)