CRM 3.0 - AD - Trusts - NT4

[Arne Janning]

Hi all,

I think I need some help from an infrastrucure architect, or something
similar.

I have a customer who runs several hundred Win2k and WinXP-clients that
authenticate against an old NT4 PDC.

In a test environment I want to simulate this and I have installed CRM 3.0
on a separate Windows 2003 Server in a new domain. I added trust
relationships between the CRM-AD-domain and an old NT4-domain. I could add
users from the NT4-domain to a network share in the AD-domain.

However, what else do I have to do so that NT4-users can access CRM?

Neither am I able to add the users through the Deployment Manager nor am I
able to add them through the web interface.

Has anyone done something similar in the past (perhaps even with 1.2)? Did
anyone already get this to work?

Any hint or advice is greatly appreciated.

Cheers

Arne Janning

[Arne Janning]

Update:

> I have a customer who runs several hundred Win2k and WinXP-clients that
> authenticate against an old NT4 PDC.

Yahoo! The customer has just agreed to migrate his domain structure to AD
(which is the best solution of course).

Anyway, it would have been interesting to know how to solve the NT4-problem.

Any ideas?

Cheers

Arne Janning

[Erik van Hoof (CWR Mobility)]

Arne,

I don't think you can, as CRM is really using active directory and not the
old domain structure...

But don't worry, just migrate and all is solved, and you will probably never
see this again (or will you?) :)

--
Erik van Hoof
CWR Mobility
Check our weblog at: http://www.cwrmobility.com/weblog

"Arne Janning" <spam.me-here...@gmail.com> wrote in message
news:%23M7Clh%23%23FHA...@tk2msftngp13.phx.gbl...

[Arne Janning]

Hi Erik!

"Erik van Hoof (CWR Mobility)" wrote

> But don't worry, just migrate and all is solved, and you will probably
> never see this again (or will you?) :)

I don't hope so :-)

Actually this is the last project for my current employer (small ISV)
because I am "migrating" myself to Avanade Germany in a few weeks (which is
a big migration, by the way). Avanade has a lot of really smart people for
every aspect of the Microsoft-universe so I'm sure there will be someone I
could ask if I'm running into infrastructure problems. At a small ISV you're
sometimes left alone.

Cheers

Arne Janning

[Erik van Hoof (CWR Mobility)]

He cool.

Avanade has some smart people (I recently teamed up with a guy who spend
last year with avanade on a big project at a dutch telco)

I was thinking about this NT4 problem the other day and a possibility is to
simply create an AD and add the User to the AD with the same UID and PWD as
he has on the old domain.

I'm running 3 domains (I know, I know...) 1 for my company, 1 for my home
and 1 for testing.
If i log in to CRM it will use the UID and PWD of the computer I logged in
to, which is the same UID and PWD on all 3 domains.

The only disadvantage is that when a user wants to change their password, it
has to be done on 2 places...

But this move to avanade means that you will not be upgrading this customer?

Good luck, and I hope we will hear more about the exiting new projects at
Avanade :)

--
Erik van Hoof
CWR Mobility
Check our weblog at: http://www.cwrmobility.com/weblog

"Arne Janning" <spam.me-here...@gmail.com> wrote in message

news:u0DvkhL$FHA....@TK2MSFTNGP11.phx.gbl...

[Markus Schmidt]

Good morning Erik,
first let me introduce myself: I am Arne's successor at GEF in Germany.
I am sure will have some fun in the future, since we've just started
some CRM projects. :-)
For that reason I'll have to deal with the problem to integrate (not
migrate!) an NT4 Domain (together with Arne until end of 2005).

>create an AD and add the User to the AD with the same UID and PWD as
>he has on the old domain.

I understood your idea and I'd like to try it. However, how can I change
a user's UID in the Active Directory?

Also, let me mention that we've successfully established a trust between
the NT4 Domain and the AD-W2003 Server (that runs CRM/SQL2005).
And - we can access and use the NT4 users on the W2003 Server (network
shares etc.). But we can't see the NT4 user's from within CRM.
Maybe there's something wrong with (or missing in) the DNS?

Any idea or suggestion?
Anyone who has already seen it working?

Markus Schmidt (Germany)

[Matt Parks]

Problem is that a mixed mode Domain is NOT supported. Part of the issue is
that CRM requires some of the advanced schema capabilities that come with a
mixed mode Domain and those NT domain users may not be able to pass the
strong reqs for security. CRM is so sensitive to this and DNS that I would
not tempt fate as you never know when a problem might hit and you would be
unsupported in anything having to do with those users.

--

Matt Parks
MVP - Microsoft CRM

"Erik van Hoof (CWR Mobility)" <van...@cwrmobility.nl> wrote in message
news:uexTXqR$FHA...@TK2MSFTNGP09.phx.gbl...

[Arne Janning]

Hi Matt and Erik!

"Matt Parks" wrote

> Problem is that a mixed mode Domain is NOT supported.

I know. We don't have a mixed-mode domain, we have a NT4 domain and a
complete separate native AD-domain with trusts.

Anyway, we just got it to work.

We configured trusts between NT4 and AD, had to change some AppPool and
service-accounts and added some Computers to the Pre-2000 compatible group.
Now we can add NT4-users to CRM using the web-client (Deployment Manager
still doesn't work). NT4-user can access CRM 3.0 using the web-client or
outlook-client without getting prompted for passwords, etc.

Anybody interested in a detailed article on how to do this?

Thanks

Cheers

Arne Janning
http://geekswithblogs.net/insidemscrm

[Erik van Hoof (CWR Mobility)]

Sure, maybe, someday, we encounter the same situation...

You don't have to make it too detailed. Just the basic setup should be
enough.

--
Erik van Hoof
CWR Mobility
Check our weblog at: http://www.cwrmobility.com/weblog

"Arne Janning" <spam.me-here...@gmail.com> wrote in message

news:eWZ6mOVA...@TK2MSFTNGP11.phx.gbl...

[Markus Schmidt]

That's what we did to make it work:

* First of all, establish a trust between the CRM-Domain and the
NT4-Domain --> Administrative Tools --> Active Directory Domains and
Trusts (direction: NT4->W2003 and W2003->NT4)

* Read CRM-Implementation Guide Chapter 15-5 carefully!!!
(Additional Installation Tasks)

Step 4.) Add the Microsoft CRM-Server and the SQL-Server COMPUTER to the
"Pre-Windows 2000 Compatible Access Group"
How-To:
a) Active Director Manager -> BuildIn -> Pre-Windows 2000 Compatible
Access Group -> Memebers -> Add
b) Open ObjectTypes and check "Computer"
otherwise you won't see any Computer
c) Add the machines (CRM/SQL Server) to that group.

Markus Schmidt

[Juan Hernandez]

I have the same problem i Install Microsoft CRM 3.0 On a Mixed Mode Domain in
Windows 2000 Server I can add users from this domain but when i try to add
users form his childs domains and error appears, I cant solve this problem,
Im Already add CRM and SQL Servers to Pre-Windows 2000 Compatible Access
Group(Is the same server and runs windows 2003 Server) But i still get errors
when try to add child domains users

Any Ideas?

[Arne Janning]

Hi Juan,

Juan Hernandez wrote:
> I have the same problem i Install Microsoft CRM 3.0 On a Mixed Mode
> Domain in Windows 2000 Server I can add users from this domain but
> when i try to add users form his childs domains and error appears, I
> cant solve this problem, Im Already add CRM and SQL Servers to
> Pre-Windows 2000 Compatible Access Group(Is the same server and runs
> windows 2003 Server) But i still get errors when try to add child
> domains users

I am the one who originally started this thread some months ago. We finally
got this to work for a german customer:

http://groups.google.de/group/microsoft.public.crm.deployment/msg/2fa1976539a8fa0a
http://groups.google.de/group/microsoft.public.crm.deployment/msg/f9a614c33e361ae0

Anyway, I think the domain in which you're installing CRM _must_ be in
Native Mode and there is no way to get around this until you install CRM in
a new native-mode-domain and establish trusts to other domains.

Cheers

Arne

[Juan Hernandez]

Correct me if i wrong but i remember CRM 3.0 Supports Both Native and Mixed
mode on domains in Win 2000 or 2003 Domains

[Arne Janning]

Hi Juan,

Juan Hernandez wrote:
> Correct me if i wrong but i remember CRM 3.0 Supports Both Native and
> Mixed mode on domains in Win 2000 or 2003 Domains

I'm a dev and not an infrastructure-expert and I might be wrong as well, but
for the Implementation Guide is clear:

For Microsoft CRM, you need only one domain in native mode. The Microsoft
CRM server and SQL Server must be in that domain.
(Chapter 6-3: Planning Microsoft CRM and Active Directory )

So I think CRM in a mixed-mode domain will not work.

Cheers

Arne

[Juan Hernandez]

Arne You are right. Thanks

[Benjie Fallar III]

the training materials for MS CRM 3.0 Installation and Configuration
dictates that MS CRM supports Mixed and Native mode AD.

Please confirm.

"Juan Hernandez" <JuanHe...@discussions.microsoft.com> wrote in message
news:890FBFDB-3220-434D...@microsoft.com...