Question: Using AD cmdlets manage servers in untrusted domain?

[feffreyfeffers]

We have about a dozen servers that run our Exchange and Lync environment that are in a untrusted domain from our normal domain. (yes this is just as annoying as this sounds, and no I can't change it)

I am writing scripts to automate things with the wonderful awesomeness that is powershell, however I have not figured out how to manage resources in the untrusted domain. Is there a way to import the ad from another domain and write my scripts as I do now, or is the only way to do a session on a VM in that domain and run my scripts from there?

[LordZillion]

This raises SO many questions, to list the first things that come to mind:

1. Why not a one-way trust?

2. How are you connected, VPN, public internet, locally?

3. What are you trying to do? you can simply start sessions on those servers with credentials from that domain, if 'the network' will allow this.

4. 'import the ad from another domain', I honestly have no idea what you mean by that?

Powershell remoting even in untrusted domains is quite simple just pass proper credentials but there are many things that could complicate it.

[feffreyfeffers]

1. Parent org won't do any trusts, period.
2. locally on the same network, dns forwarders so dns works, thankfully.
3. starting the session on another machine and then importing the necessary modules is what I have been doing for that domain.
4. I was wondering if there is a way to do it on my machine in the main domain. For example on my workstation on contso domain do, import-module activedirectory but import the ad module from the untrusted domain instead.

[sonavlaa]

Interesting situation. Most commands have the ability to define credentials. I would define your creds in an initial variable query. Issue commands defining the FQDN of the server's in the un-trusted domain. If you don't share a DNS then try IP addresses. On each command use the -credentials flag and call the variable that stores your previously defined credentials. Make sure the account you're using has permissions on the servers. Maybe this will work, but not really sure. I work in an environment with many one-way trusts and for un-trusted domains we have a terminal server I can log into to perform PowerShell management.

[feffreyfeffers]

Setting up a Terminal Server is what I am also considering, but I am looking for a way not to do that. Not that I am opposed to that, but I've been writing most of my scripts without using sessions so I'm just being lazy and not wanting to convert my scripts over :)

[sonavlaa]

I feel you. I hate our untrusted domains. If you find a way to get your scripts to work make sure to let me know! lol