B.3 Troubleshooting

B.3.1 Unable to manage child, trusted, and untrusted domains.

The errors encountered during domain import were related to the failure to import the only two GPOs in that domain, because of UNC Hardening.

Follow the instructions below to grant the Gateway machine access to SYSVOL on the domain controllers (DCs) in that untrusted domain:

  • UNC hardening policy (For Untrusted Domains):

    • Open the local group policy editor on the gateway machine (gpedit.msc).

    • Navigate to Computer Configuration > Administrative Templates > Network > Network Provider > Hardened UNC Paths.

    • Enable the policy and add the following entry:

      1. Path: \\adbdemo.local\SYSVOL

      2. Settings: RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0

      3. Alternatively, you can use \\dcname.adbdemo.local or \\*.adbdemo.local for testing purposes (the GUID will change).

    • Browse from the gateway to the untrusted domain using the following path:\\adbdemo.local\SysVol\adbdemo.local\Policies\{3b547bb5-ad82-485f-8c39-405d4bcdb0bc}

    • Replace "adbdemo" with the domain you want to configure.