Trust Creation Fails When You Create a Trust with a Windows NT 4.0 Domain During Upgrade to Windows Server 2003 (817012)


The information in this article applies to:

  • Microsoft Windows Server 2003, 64-Bit Datacenter Edition
  • Microsoft Windows Server 2003, 64-Bit Enterprise Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Small Business Server 2003, Premium Edition
  • Microsoft Windows Small Business Server 2003, Standard Edition

SYMPTOMS

When you use the Active Directory Domains and Trusts console to create a trust with a Microsoft Windows NT 4.0 domain, the trust operation appears to complete, but it may not function consistently or correctly.

CAUSE

This problem may occur when the administrator of a Microsoft Windows 2000 domain or a Windows Server 2003 domain starts to create a trust for a Windows NT 4.0 domain (incoming or outgoing) but does so only on the side of Windows 2000 or Windows Server 2003. Before completing the trust on the Windows NT 4.0 domain side, the administrator upgrades the Windows NT 4.0 domain to Windows Server 2003. The administrator then completes the trust-creation process after the upgrade process is complete. In this scenario, the trust exists but only with the following limitations:
  • The trust cannot be verified, upgraded, or converted to a two-way trust.
  • If the initial trust was created as incoming, it cannot be used for authentication.
Note The trust, as initially created, is neither complete nor functional.

RESOLUTION

To resolve this issue, remove the trust, and then re-create it.

To open Active Directory Domains and Trusts, click Start, point to Control Panel, point to Administrative Tools, and then click Active Directory Domains and Trusts.

To remove a trust, follow these steps:
  1. Open Active Directory Domains and Trust.
  2. In the console tree, right-click the domain that contains the trust that you want to remove, and then click Properties.
  3. Click the Trusts tab, select the trust that you want to remove, and then click Remove.
  4. Follow the directions on the screen to remove the trust from the domain.

STATUS

Microsoft has confirmed that this is a bug in the Microsoft products that are listed at the beginning of this article.
Modification Type:MajorLast Reviewed:12/19/2003
Keywords:kbbug KB817012
©2003 Microsoft Corporation. All rights reserved.