Setting up SCCM on multiple domains

Question

In a lab environment, I am attempting to configure an SCCM server (2007) to be our patch solution across three different domains.

DOMAIN A (domA.sample):
The trusted domain. SCCM01 (Server) is on this network.

DOMAIN B (domB.sample):
One way trust between the two domains. DOMAIN B trusts DOMAIN A, but not the other way around.

DOMAIN C (domC.sample):
No trust between this domain and any other domain.

SCCM is set up and running on DOMAIN A. Any server on that domain will receive patches. I am currently working on Domain B (1-way trust). I am unable to add find the systems in my SCCM server. I am able to install the client manually on ServerA.domB.sample, and the site code comes back correct, even if I rediscover the site code, but somehow the ServerA is not communicating with SCCM01.

What I've tried:

http://social.technet.microsoft.com/Forums/en-US/configmgrgeneral/thread/6f06bbf1-6ff4-4a41-9d42-894c1a6e13ea
http://scexblog.blogspot.com/2010/06/sccm-discover-another-trusted-domain.html

Any one have experience with SCCM?

score 1 · Accepted Answer · edited Feb 09 '13 at 08:36

1

I want to say that I don't think that the trust matter all that much. It's been a while since I went through this, so I don't want to give you any BS answers. But from what I vaguely recall, I think it has something to do with setting up an SCCM Network Access Account.

Here is some reading for you:

edited Feb 09 '13 at 08:36

j0k

401
9
16

answered Feb 09 '13 at 04:36

The_Ratzenator

150
1
2
12

It turns out we were able to get it working. A few things hindered us (so if you are trying to do this, you may want to check them out). 1) Someone decided to "harden" the systems by making registry changes. Get SCCM (or any application) working PRIOR to hardening. 2) configure IP ranges. That was the big issue I was having. The above links should help out as well (thanks Ron). – Jeff Feb 11 '13 at 17:35

score 0 · Answer 2 · answered Sep 11 '12 at 17:31

0

If the end goal is simply to have a patching solution across disparate domains, SCCM is probably more trouble than it's worth. You can setup WSUS and just use group policy in each domain to point to it. Client-side targeting would also allow you to keep the groups of systems separate.

If SCCM is actually required for other reasons, I'll leave it to other answers to provide that help.

answered Sep 11 '12 at 17:31

Ryan Bolger

16,472
3
40
59

Unfortunately, I do have to use SCCM. I may be able to implement something else as a back up (scripts, altiris, something else), but SCCM has been designated as the primary solution. – Jeff Sep 11 '12 at 20:07

score 0 · Answer 3 · answered Feb 11 '13 at 17:46

Another "work-around" type answer:

cls

$myScriptPurpose = "Welcome!"

$mytrash = "c:\temp\trashFile.txt"


function getCred {

    $mycredential = $host.ui.promptforcredential("patch systens", "Please enter your user name and password.", "", "NetBiosUserName") 

    if(!$mycredential) {
        $myErr = "Please enter a value!"
        $myErr
        exit
    }

    $mypass = $mycredential.getNetworkCredential().password
    $myuser = $mycredential.getNetworkCredential().username
    $mydomain = $mycredential.getNetworkCredential().domain



    $isDomain1 = [string]::Compare($mydomain, "domain1", $True)
    $isDomain2 = [string]::Compare($mydomain, "domain2", $True)




    if ($isDomain1 -eq 0) {
        $myservers = get-content input\domain1ListOfServers.txt
        $myoutputfile = "output-domain1.txt"
    }
    elseif ($isDomain2 -eq 0) {
        $myservers = get-content input\domain2ListOfServers.txt
        $myoutputfile = "output-domain2.txt"
    }
    else {
        $myErr = "Unknown domain!"
        $myErr
        exit

    }


    $emptyStr | out-file $Myoutputfile

}



function patch {

    foreach ($server in $myservers) {
                Write-host "Copying folder."
        xcopy  c:\pathToPatches \\$server\c$\temp\patchJob /Y > $myTrash
        write-host "Installing patches on $server."
        psexec \\$server -u $mydomain\$myuser -p $mypass -i c:\temp\patchjob\install.vbs 2> $myTrash

        write-host "Cleaning up."
                psexec \\$server -u $mydomain\$myuser -p $mypass -i del "c:\temp\patchjob\install.vbs" 2> $myTrash
        Write-host " Done."

    }
}


function cleanUp {

    del c:\temp\trashFile.txt

    Remove-Variable my*
    Remove-Variable is*
}





getCred
patch
cleanup

Setting up SCCM on multiple domains

3 Answers3