EXTRANET domain should include the IP address of the EXTRANET-DC server. in Font

Encoder PDF417 in Font EXTRANET domain should include the IP address of the EXTRANET-DC server.

Figure 1-8. New Domain Name dialog box 5. On the NetBIOS Domain Name dialog box, type EXTRANET and then click Next (see Figure 1-9).

6. On the Database And Log Folders dialog box, we ll retain the defaults. In a production environment, you would typically place the Active Directory database and logs on separate volumes, but we ll keep things simple here. Click Next. 7. On the Shared System Volume dialog box, click Next to accept the default location. 8. Choose Install And Configure The DNS Server On This Computer, And Set This Computer To Use This DNS Server As Its Preferred DNS Server and then click Next, as shown in Figure 1-10. As noted previously, this will make the EXTRANET-DC server a DNS server as well. Other computers in the EXTRANET domain should include a reference to EXTRANET-DC s IP address in their Network DNS Server lists.

Figure 1-10. DNS Registration Diagnostics dialog box 9. Select Permissions Compatible Only With Windows 2000 Or Windows Server 2003 Operating Systems on the Permissions dialog box and then click Next. Reboot the computer and voila! Your domain controller is ready for use. This server will handle all login authentications for the EXTRANET domain.

A one-way trust from the INTRANET to EXTRANET domains will allow users in the INTRANET domain to access resources in the EXTRANET domain without the need to log in a second time.

Note A trust does not eliminate the need to grant permissions to INTRANET users in the EXTRANET domain; whether at the file system, IIS, or SharePoint levels, you must still grant permissions to resources as you would for EXTRANET users. The trust simply tells the EXTRANET domain to accept that INTRANET domain users are who they say they are without forcing them to log in again.

To create the trust, follow these steps: 1. On the EXTRANET-DC server, open the Active Directory Domains And Trusts application from the Administrative Tools menu. The Active Directory Domains And Trusts dialog box displays, as shown in Figure 1-11.

Figure 1-11. Active Directory Domains And Trusts dialog box 2. Right-click the domain extranet.mycompany.com (or whatever your domain name may be), select the Trusts tab, and then click the New Trust button (see Figure 1-12). The New Trust Wizard launches.

3. On the Trust Name dialog box, enter the name of the INTRANET domain and then click Next (see Figure 1-13).

Figure 1-13. Trust Name dialog box 4. Select a One-Way: Outgoing trust and click Next (see Figure 1-14).

5. On the Sides Of Trust dialog box, select Both This Domain And The Specified Domain to create the trust entries on both the EXTRANET and INTRANET domains; then click Next (see Figure 1-15).

Note If you choose This Domain Only, you will need to log in to the INTRANET-DC server and repeat this

Figure 1-15. Sides Of Trust dialog box 6. Enter the Administrator username and password for the INTRANET domain and click Next (see Figure 1-16).

7. Click Next twice, acknowledging the trust configuration. Select Yes, confirm the outgoing trust, and click Next. 8. Click Finish. 9. Acknowledge the dialog box regarding SID filtering. 10. To verify that the trust has been configured, open the domain Properties dialog box again, select the Trusts tab, and confirm that the INTRANET domain is listed in the Domains Trusted By This Domain list (see Figure 1-17).

Figure 1-17. Trusts tab displaying completed trust relationship You can repeat the previous step on the INTRANET-DC server, and you will see the extranet.mycompany.com in the Domains That Trust This Domain list.

Microsoft Certificate Services (MCS) can be used to issue and establish the authenticity of SSL certificates, both within and between organizations. MCS is used here to allow us to test SSL without purchasing a commercial certificate from an independent CA such as VeriSign.

Note If you have a certificate from an independent CA, such as VeriSign, you might use it rather than