WSTEP enrollment can use Kerberos authentication to authenticate Windows endpoints. For cross-forest deployments, Windows endpoints are located using Kerberos V5 LDAP referrals. The domain controller (Active Directory Domain Services), maintains referral data in its Configuration container, in crossRef objects. For more information about referrals, see the Microsoft documentation.

For cross-forest deployments with WSTEP enrollment, you must manually add a crossRef object into the domain controller for each cross-forest domain that you must support.

To add a cross-forest referral in a domain controller for cross-forest deployments

  1. Open ADSI Edit. Select Start > Windows Administrative Tools > ADSI Edit.
  2. Connect to the Configuration context.
    1. Select Action > Connect to.
      A Connection Settings dialog box appears.

    2. In the Name field, enter a unique name for the connection.

    3. Under Connection Point, click Select a well known Naming Context, and then select Configuration.

    4. Under Computer, click Select or type a domain or server, and then enter the server and port of the domain controller, using the form <server>:<port>. If you are on the server hosting the domain controller, you can enter localhost for <server>.

    5. Click OK.

  3. Expand the configuration connection that you just created.

  4. Expand CN=Configuration,<suffix> > CN=Partitions.
    Where <suffix> is the suffix (distinguished name) of the domain controller.

  5. Select CN=Partitions, and then select Action > New > Object.
    A Create Object dialog box appears.
  6. Select crossRef.
  7. Click Next.
  8. In the Value field, enter the NetBIOS name of a cross-forest domain.
  9. Click Next.
  10. In the Value field, enter the distinguished name of the cross-forest domain.
  11. Click Next.
  12. In the Value field, enter the DNS name of the cross-forest domain.
  13. Click Next.
  14. Click Finish.
    A crossRef object is added for the cross-forest domain.
  15. Repeat this procedure for each cross-forest domain the domain controller must support for cross-forest referrals.