Client management for trust between an outside domain + SCCM
Question
Guys,
Can we use our existing SCCM Infra to manage client If we have a trust between an outside domain ?
Please share any reference URL to check the configuration and prerequisites.
Answers ( 5 )
Hello – If I understand your question correctly,
You want to install and manage clients who are in the untrusted forest.
If so, this is possible –
– Your Primary server in Domain A
– Your Client is in Domain B
– There is no trust between Domain A and B
– If you want to manage clients in Domain B
— You need to install Remote MP, DP, and SUP in domain B
— If that is installed you can install and manage clients from Domain B without any issue
Real world example is provided here
https://www.anoopcnair.com/untrusted-forest-sccm-mp-rotation-issue/ (Ignore the MP rotation issue this issue is resolved in the latest version of SCCM)
Make sure you read https://www.anoopcnair.com/remote-dp-installation-error-0x800706ba/?asd to get more details about other requirements like Require the site server to Initiate Connection to this Site System
KR
Anoop
https://www.anoopcnair.com/
Thank you .. Would appreciate if you could please clarify:
1. It it mandatory to setup additional server for MP/DP/SUP ? Also want to know if there any DNS configuration / Schema extension and AD privileged required to manage and remotely to sccm client installation for external domain systems?
2. if there conflict of the IP Subnet range for the external domain infra and current infra then does any configuration changes required to be done in the SCCM infra side ?
1. Yes if you don’t have two-way trust between Domain A and B as I mentioned above.
1.a. You can’t use client push method
1.b. AD Schema, DNS always recommended
2. It’s standard ..you need to take care IP ranges ..
conflict is ok for content
conflict is NOT ok for site assignment
Thank you for the responses.. Just to clarify since in the current infra AD Schema is already extended however does still AD Schema needs to extended on external domain forest as well ?
If it’s different “forest“ all together, then YES you need to ad schema extension
https://www.anoopcnair.com/learn-how-to-extend-ad-schema-for-sccm/