Question

I found a Microsoft support article that describes the exact scenario except the article addresses Server 2003 instead of Server 2008R2: http://support.microsoft.com/?kbid=830576 .

The resolution in the article is to establish a two way trust between forests so the trusting domain can access the Kerberos key server in the trusted domain. That is unfortunately not a possibility in this network.

I’m hoping there is some other way to get Kerberos happening between these two domains even though the trust is only one direction.

Answer 1

The link says it straight out: you need a two way trust. No other option. This is how we do it with tens of subdomains.