How can I map a network drive from another domain?

Question

I am using terminal-service server with Windows Server 2012 and we have two terminal servers share trough NLB, users connect to a terminal in the DOMAIN1 domain with Remote Desktop Connection (see picture below).

I need to map a network drive for the users in terminal to a share on another domain (DOMAIN2 which has the domain controller Windows Server 2003). I try creating a GPO in DOMAIN1 through DC1 (domain controller for DOMAIN1 with Windows Server 2012) to map the network drive.

DC1 and DOMAIN2 are physically connected in the same network.

How to map a network drive to a share in the other domain (DOMAIN2) on terminals in the main domain (DOMAIN1)?

Solution 1

The short answer is - you probably need to look at a trust relationship between your two domains. If that exists, then you'll be able to use authentication between them, and so 'everything' will work normally.

The longer answer: When you log in to a Kerberos Realm (which is more or less what a Windows Domain is) you're issued a Ticket Granting Ticket - TGT - you can see this on your host when you run klist. This ticket is used for granting access to resources within the Domain - you ask for permission to access \\servername\sharename and your domain controller issues you with an access ticket.

When you go cross domain, that mechanism doesn't exist - your ticket isn't 'valid' as far as the remote domain is concerned.

You can either: Log in as a domain user in the remote domain (getting tickets/authentication from another source as well) or establish a trust relationship, such that you are deemed a valid user.

Solution 2

You can use Group Policy Extensions for that. (Map Network Drive). If your Domains are not trusted, you either Need to have the same users on both sides with the same Passwords, or you Need to provide a Password on the Map Network Drive Dialog in the GPO.

If that's also not an Option, you could use a Login script which issues a net use \\server\path /USER:DOMAIN2\user which will then ask a Password from the user.

Comments

[Eduard Florinescu]

If I try to see the drive from the terminal server it asks for the credentials if I try from the terminal client I receive a network error.

[Eduard Florinescu]

If I try to see the drive from the terminal server it asks for the credentials if I try from the terminal client I receive a network error Windows cannot access \\etc.

[Sobrique]

If you supply credentials from the correct domain, can you map a drive?

[Eduard Florinescu]

Yes, if I supply the credentials in the GPO then I can map the drive. And then I can see also other paths on the same server

[MichelZ]

What do mean by that? Are you trying from the actual client? or from within the TS session?

[Eduard Florinescu]

from a TS session with a user account and not an administrator account

[Sobrique]

OK. So you could share, and allow access to that userid. Or set up the domain trust relationship. Doesn't look like you have a firewall or other bogosity interfering.