
Please choose the External Trust on both domains.
Install Windows server support tools on VAN.COM
Disabling the SID Filtering by:
C:\Program Files\Support Tools>netdom trust van.com /domain:vanstudents.com /quarantine:no /usero:administrator /passwordo:password
setting the trust to not filter SIDs.
The command completed successfully.
C:\Program Files\Support Tools>netdom trust vanstudents /domain:van /quarantine:no /usero:administrator /passwordo:password
Setting the trust to not filter SIDs.
The command completed successfully.
Install ADMT 3.0.1 on Windows Server 2003 domain: VAN.COM;
C:\>Admt KEY /option:create /SourceDomain:VANSTUDENTS /KEYFILE:mypass
The password export server encryption key for domain 'VANSTUDENTS' was successfully created and saved to 'C:\mypass.pes'.
Copy the following file from C:\Windows\ADMT directory to the domain controller of VANSTUDENTS domain:
Instmsiw.exe
PwdMig.exe
PwdMig.ini
PwdMig.msi
Don't use the files from Windows Server 2003 CD.
Copy the mypass.pes to the domain controller of VANSTUDENTS domain.
Create a domain user: User1 in VAN.COM domain; It will be used to start the PES service in VANSTUDENTS domain.
ADD VAN\Administrator to VANSTUDENTS\Administrators domain local group. Please don't forget this step.
At VANSTUDENTS domain controller, run PwdMig.msi,
Reboot the Domain Controller of VANSTUDENTS domain.
Start the Password Export Server service (only when you migrate the password.)
Run ADMT tools from domain controller of VAN.COM domain;
Make sure that Password Export Server starts at the VANSTUDENTS.COM!


Answer YES to all the prompts shown.
Reboot the domain controller of VANSTUDENTS.COM
AND Make sure that Password Export Server starts at the VANSTUDENTS.COM!
Re-run the Migration Wizard

Both Office and Order users' profile and application settings are kept. The MS OUTLOOK settings and OUTLOOK Express settings are kept.=============


As shown above, the trust type is an important concept. Because I raised both Contoso.com and VAN.COM to Forest Functional Level, I can have the forest-wide trust type established.









Setup RRAS 2 server:
Pay attendtion to the user name: RRAS 2--the Demand-dial interface name;


Creator Owner has Full Permissions on Subfolders and files.
Both Everyone and ANONYMOUS LOGON have the Write Attribute denied.
