AD Forest Trust Configuration Between On-Prem AD and AWS Domain Controllers

Question

I have a question about building an Active Directory (AD) trust between on-premises AD and AWS managed instances.

For on-prem AD, the top-level domain (TLD) is configured as contoso.local, while on AWS, the environment is set up with aws.contoso.local. I attempted the standard procedure of adding DNS forwarders for aws.contoso.local, but it resulted in the following error:

Command failed: DNS_ERROR_ZONE_CONFIGURATION_ERROR     9604    0x2584 

Is it possible to configure an AD Forest trust for this kind of scenario by adding a delegation for aws.cotoso.local in my on-prem DNS server? Can AD Forest trust be created? Or do I need to create Realm Trust?

Answer 1

Hello

Thank you for posting in Q&A forum.

The error DNS_ERROR_ZONE_CONFIGURATION_ERROR indicates a problem with the DNS zone configuration

To resolve this, you can try the following steps:

1. Flush DNS Cache: Sometimes, a corrupted DNS cache can cause issues Open Command Prompt as an administrator and run the following command:

ipconfig /flushdns

This will clear the DNS cache and might resolve the issue

2. Check DNS Zone Configuration: Ensure that the DNS zone for aws.contoso.local is correctly configured on your on-premises DNS server. You can do this by opening the DNS management console and verifying the settings for the conditional forwarder.
3. Create Conditional Forwarder: If not already done, create a conditional forwarder for aws.contoso.local on your on-premises DNS server. This will help in resolving DNS queries for the AWS-managed domain.
4. Verify Network Connectivity: Ensure that there is proper network connectivity between your on-premises network and the AWS VPC where the AWS Managed AD is hosted. Check that the necessary ports are open and that there are no firewall restrictions blocking traffic.

Regarding the type of trust, you can create either a Forest Trust or a Realm Trust depending on your requirements. A Forest Trust is typically used to share resources between multiple forests and is transitive, meaning it can extend beyond the two forests involved. A Realm Trust is used for cross-platform communication between a Windows domain and a non-Windows Kerberos realm.

steps to set up an Active Directory (AD) Forest Trust between your on-premises AD and AWS Managed AD:

Prerequisites

1. Network Connectivity: Ensure that your on-premises network can connect to the AWS VPC where the AWS Managed AD is hosted. Open the necessary ports (TCP/UDP 53, 88, 389, 445, etc.) on your firewall.
2. Conditional Forwarder: Create a conditional forwarder on your on-premises DNS server for the AWS Managed AD domain.

Steps to Create a Forest Trust

1. Prepare On-Premises AD:

Open the Active Directory Domains and Trusts console on your on-premises domain controller.

Right-click the Domain node and select Properties.

Go to the Trusts tab and click New Trust.

2. Create the Trust:

Select Forest trust and click Next.

Enter the Domain name of the AWS Managed AD (e.g., aws.contoso.local).

Choose the Trust type (one-way or two-way).

Enter the Trust password and confirm it.

Select the Authentication level (e.g., All, Selective).

Click Next and review the summary.

Click Finish to create the trust.

3. Create Conditional Forwarder:

Open the DNS Manager on your on-premises domain controller.

Right-click Conditional Forwarders and select New Conditional Forwarder.

Enter the Domain name of the AWS Managed AD and the IP addresses of the AD controllers.

Click OK to create the conditional forwarder.

4. Verify the Trust:

Use the Active Directory Domains and Trusts console to verify the trust status.

Ensure that the trust is listed and active.

Best regards

Yanhong

=====================================

If the answer is helpful, please click "Accept answer" and upvote it