AD Forest Tips and FAQs

Can I exclude a trusted domain from windbind operations?

Yes. In order to do this, you need to re-authenticate to the ADS. Configure using the "advanced ADS" option for AD authentication. See Apply AD Authentication with Advanced Options. You will need to exclude the domain using the AD Domains to exclude (Default = '') option.

Example:

Note: Entries in green are the unique values to enter for this example.

Log in to the Appliance Controller CLI.
Enter:
```
auth config ads nasadmin dc1
```
Enter the ID mapping option to use (in this example, we pressed <Enter> to accept the default).

ID mapping to use: qtm_guid, rfc2307, rid, or tdb (Default = qtm_guid):

Enter yes to configure with advanced options:

Do you want to configure advanced options (yes/No)? yes

Enter the domain or domains (by adding a comma between domains) to exclude:
```
AD Domains to exclude (Default = ''): DOM1, DOM2
```
Enter the AD organizational unit (in this example, we pressed <Enter> to accept the default):
```
AD Organizational Unit (Default = 'Computers'):
```
Enter the AD machine account (in this example, we pressed <Enter> to accept the default):
```
AD Machine Account (Default = NAS233):
```
Enter yes to allow trusted domains (we excluded the two domains earlier):
```
Allow Trusted Domains (Default = 'no'): yes
```

Enter the user account password:

Please enter the password for user nasadmin:

How can I allow a user from a trusted domain to access NAS shares?

ADS authentication limits user access to the domain that it's bound to. If users from other AD domains need to connect to NAS shares that are in another AD domain that is part of the same AD Forest, configure the "advanced ADS" option for AD authentication. See Apply AD Authentication with Advanced Options.

Example:

Note: The entry in green is the unique value to enter for this example.

Log in to the Appliance Controller CLI.
Enter:
```
auth config ads nasadmin dc1
```
Enter the ID mapping option to use (in this example, we pressed <Enter> to accept the default).

ID mapping to use: qtm_guid, rfc2307, rid, or tdb (Default = qtm_guid):

Enter yes to configure with advanced options:

Do you want to configure advanced options (yes/No)? yes

Enter the domain or domains (in this example, we pressed <Enter> to accept the default, since we aren't excluding any):
```
AD Domains to exclude (Default = ''):
```
Enter the AD organizational unit (in this example, we pressed <Enter> to accept the default):
```
AD Organizational Unit (Default = 'Computers'):
```
Enter the AD machine account (in this example, we pressed <Enter> to accept the default):
```
AD Machine Account (Default = NAS233):
```

Enter yes to allow trusted domains:

Allow Trusted Domains (Default = 'no'): yes

Enter the user account password:

Please enter the password for user nasadmin: