search

timmcmic / DLConversionV2

MIT License
44 stars 9 forks source link

Unable to locate normalized recipients across multiple domains / child domains single forest. #37

Closed timmcmic closed 2 years ago

timmcmic commented 2 years ago

Encountered scenario where customer had additional trees and child domains within the forest. During the normalization function for each recipient dependency the get-adobject call was issued but if the object did not exist in the same domain as the group it would fail.

Created a new function get-activeDirectoryDomainName that takes the DN and strips out the domain portion. Then changed all get-adobject referneces to use the -server which and then the domain name in FQDN format. This allows a domain referral to occur and the object to be found across domains.

MassimoPascucci commented 2 years ago

This seems… less than ideal. Connecting to a domain using its DNS name will use DNS round robin to point to a random DC for that domain, which in a large environment could be anywhere in the world.

Also, it seems to cause authentication issues (see #51).

I’m a bit puzzled by the issue existing at all: a Global Catalog should be able to answer that kind of query about any object in the forest.

I think the real issue is that you are not actually talking with the GC service in your queries. To do that, you need to specify TCP port 3268:

Get-AdObject -Server ($globalCatalogServer + ':3268')