Active Directory Domains and Trusts

Domain Trust and AD Groups

Posted by robd on April 26, 2023
powershell / No Comments

The company I work for is much like the Borg where they like to assimilate new companies.

Part of this assimilation often involves a domain trust and adding users from one domain to a second domains AD groups to gain access to permissions in Domain 2.

This is really useful if your giving a user a laptop on domain 1 but they need access to files on domain 2.


My Mate Handsom Dave came up with this script too:

Compare users from Domain 1 and Domain 2 on display name (username didnt match),

Get the Domain 2 groups,

Look at domain 2 groups members,

If they exist in domain 1 then add those people into the group in Domain 2.

Remember: The AD groups need to be Domain Local.



#Get the users from domain1
$domain1 = get-aduser -filter * -Server
#get the users from domain2
$domain2 = get-aduser -filter * -Server
#compare the users on name (not username as they didnt match)
$usercompare = Compare-Object -ReferenceObject $ -DifferenceObject $ -IncludeEqual
#If its the same then save to this variable
$inboth = $usercompare | where {$_.sideindicator -eq "=="}
#In Domain 2 get all the AD groups that start with ACL_
$domain1groups = Get-ADGroup -filter {name -like "ACL_*"} -Server

#Here we go
foreach ($group in $domain1groups)
    #get the ad members from the acl group 
    $domain1groupmembers = Get-ADGroupMember $ -Server 
    foreach ($groupmember in $domain1groupmembers) 
        #if the member of the group matches someone in the inboth variable
        if ($inboth.inputobject -contains $ 
        $domain2userobject = Get-ADUser -Filter {name -like $} 
        # add that domain 1 person to the domain 2 ad group
        Add-ADGroupMember -Identity $group -Members $domain2userobject -server -WhatIf




Tags: , , , ,

Outlook Anywhere with Additonal UPN suffix

Posted by robd on February 03, 2015
Active Directory Sites and Services, exchange 2010 / 1 Comment

So today we had a requirement to start using Outlook Anywhere (Outlook over RPC) on our Exchange 2010 server, the setup is dead easy:

Logon to your CAS server,

Install the server feature “RPC over HTTP Proxy”,

Open the Exchange Management consol and go to Server Configuration and Client Access, Click Enable Outlook Anywhere,

Use your domain (you dont need HTTP/S), choose your authentication and if you need to offload your certificate to another server:


Thats the Exchange bit done.

Next change your DNS:

Locally and externally you need two things; an A record and a SRV record both need to point at Autodicsover.DOMAIN.ORG, here’s two examples from 123 reg:

Website2 Website3

Finally make sure 443 is allow through your Firewall.

Last but not least test with:

Ok so now onto the UPN bit, in my case my email differed from my domain i.e. my domain is bohemian.local and my email domain is

What this means is when logging on via Outlook I get prompted to type domain and password:

hmsg1hmsg2 hmsg4

If you’d rather not do this then you need to add your email domain as a UPN suffix.

To do this, on a DC open: Active Directory Domains and Trusts

rom the displayed context menu, click Properties.


On the properties box that appears, in the Alternative UPN suffixes field, specify the desired alternate UPN suffix for the domain and click Add.


Apply and ok. Finally open Active Directory Users and Computer

Find a user and under User logon name section, choose the alternate UPN suffix from the drop-down list that was created earlier in Active Directory Domains and Trusts snapin.



Then test Outlook Anywhere using the users email as the username.


Tags: , ,