Multi Domain Replication Security Issue

Hello everyone,
We have a bit of a problem with replication between two SQL servers
belonging to different domains.
Basically we have two active directory domains: DomA and DomB (neither of
them is local domain).
Each of then has a SQL Server 2000 Enterprise edition installed with SP3.
There is a database on DomA that has to be merge replicated with DomB
through dial-up connection.
We establish the dial-up connection (RRAS is running on DomA) between the
domains and create a pull subscription on DomB but when we start the
synchronisation process we always get the error that server in DomA does not
exist or access denied.
Just to mention that the replication agent on DomB is set up to run with sql
server login 'sa' (checked the password a hundred times).
Any ideas appreciated. We would not mind switching to active directory
enabled replication between the two is someone could give us guidelines.
Thank you all in advance.
Best regards,
GAZCreate an admin account on both servers with the same name and password.
Have sql server agent run under this account on both servers. Use the
impersonate the sql server agent option.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"asd" <asd@.asd.com> wrote in message
news:uJmqQCaIGHA.3176@.TK2MSFTNGP12.phx.gbl...
> Hello everyone,
> We have a bit of a problem with replication between two SQL servers
> belonging to different domains.
> Basically we have two active directory domains: DomA and DomB (neither of
> them is local domain).
> Each of then has a SQL Server 2000 Enterprise edition installed with SP3.
> There is a database on DomA that has to be merge replicated with DomB
> through dial-up connection.
> We establish the dial-up connection (RRAS is running on DomA) between the
> domains and create a pull subscription on DomB but when we start the
> synchronisation process we always get the error that server in DomA does
> not exist or access denied.
> Just to mention that the replication agent on DomB is set up to run with
> sql server login 'sa' (checked the password a hundred times).
> Any ideas appreciated. We would not mind switching to active directory
> enabled replication between the two is someone could give us guidelines.
> Thank you all in advance.
> Best regards,
> GAZ
>|||Thanks for the aswer but unfortunately it does not work. We still get the
same message 'SQL server does not exist or access denied.'
We can ping the server in question with both the IP address and its name,
but still we cannot run the replication.|||Is the sa account you are using in your agent to connect to the subscriber
the publisher sa account or the subscriber one? It should be the publisher
one.
This could be a name resolution problem or a account problem. It sound like
its not a name resolution problem as you can connect to the publisher and
configure the pull. So it probably is an account problem.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"asd" <asd@.asd.com> wrote in message
news:ujJqbTbIGHA.3752@.TK2MSFTNGP11.phx.gbl...
> Thanks for the aswer but unfortunately it does not work. We still get the
> same message 'SQL server does not exist or access denied.'
> We can ping the server in question with both the IP address and its name,
> but still we cannot run the replication.
>|||Hello,
You could check the job owner of the merge job:
1. Right click the pull subscription->Properites->Synchrnization->Agent
Properites
2. Change the job owner to the local account with SQL system admin account
on both local and resmote server to test.
Best Regards,
Peter Yang
MCSE2000/2003, MCSA, MCDBA
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
========================================
=============
Business-Critical Phone Support (BCPS) provides you with technical phone
support at no charge during critical LAN
This posting is provided "AS IS" with no warranties, and confers no rights.
--
>From: "Hilary Cotter" <hilary.cotter@.gmail.com>
>References: <uJmqQCaIGHA.3176@.TK2MSFTNGP12.phx.gbl>
<e9uuFgaIGHA.596@.TK2MSFTNGP10.phx.gbl>
<ujJqbTbIGHA.3752@.TK2MSFTNGP11.phx.gbl>
>Subject: Re: Multi Domain Replication Security Issue
>Date: Wed, 25 Jan 2006 09:48:50 -0500
>Lines: 26
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.3790.1830
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
>X-RFC2646: Format=Flowed; Response
>Message-ID: <#s1N35bIGHA.3408@.TK2MSFTNGP12.phx.gbl>
>Newsgroups:
microsoft.public.sqlserver.relationalserver.performance,microsoft.public.sql
server.replication,microsoft.public.sqlserver.security,microsoft.public.sqls
erver.securitytools
>NNTP-Posting-Host: 165.1.27.105
>Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.phx.gbl
>Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.sqlserver.replication:68745
microsoft.public.sqlserver.security:26245
microsoft.public.sqlserver.securitytools:1079
microsoft.public.sqlserver.relationalserver.performance:117
>X-Tomcat-NG: microsoft.public.sqlserver.security
>Is the sa account you are using in your agent to connect to the subscriber
>the publisher sa account or the subscriber one? It should be the publisher
>one.
>This could be a name resolution problem or a account problem. It sound
like
>its not a name resolution problem as you can connect to the publisher and
>configure the pull. So it probably is an account problem.
>--
>Hilary Cotter
>Looking for a SQL Server replication book?
>http://www.nwsu.com/0974973602.html
>Looking for a FAQ on Indexing Services/SQL FTS
>http://www.indexserverfaq.com
>"asd" <asd@.asd.com> wrote in message
>news:ujJqbTbIGHA.3752@.TK2MSFTNGP11.phx.gbl...
the[vbcol=seagreen]
name,[vbcol=seagreen]
>
>|||Both sa accounts have the same password. Whatever we try there are no
results. We shall try to create a clean domain B installation and start from
scratch. Maybe we shall have better luck this time.
Still, any ideas and suggestions are welcome.
BR,
GAZ
"Hilary Cotter" <hilary.cotter@.gmail.com> wrote in message
news:%23s1N35bIGHA.3408@.TK2MSFTNGP12.phx.gbl...
> Is the sa account you are using in your agent to connect to the subscriber
> the publisher sa account or the subscriber one? It should be the publisher
> one.
> This could be a name resolution problem or a account problem. It sound
> like its not a name resolution problem as you can connect to the publisher
> and configure the pull. So it probably is an account problem.
> --
> Hilary Cotter
> Looking for a SQL Server replication book?
> http://www.nwsu.com/0974973602.html
> Looking for a FAQ on Indexing Services/SQL FTS
> http://www.indexserverfaq.com
> "asd" <asd@.asd.com> wrote in message
> news:ujJqbTbIGHA.3752@.TK2MSFTNGP11.phx.gbl...
>|||To be sure we started off with jobs being owned by the domain admin
accounts. No avail.
Any thoughts appreciated.
BR,
GAZ
"Peter Yang [MSFT]" <petery@.online.microsoft.com> wrote in message
news:Cs4jakhIGHA.3944@.TK2MSFTNGXA02.phx.gbl...
> Hello,
> You could check the job owner of the merge job:
> 1. Right click the pull subscription->Properites->Synchrnization->Agent
> Properites
> 2. Change the job owner to the local account with SQL system admin account
> on both local and resmote server to test.
> Best Regards,
> Peter Yang
> MCSE2000/2003, MCSA, MCDBA
> Microsoft Online Partner Support
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ========================================
=============
> Business-Critical Phone Support (BCPS) provides you with technical phone
> support at no charge during critical LAN
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> --
> <e9uuFgaIGHA.596@.TK2MSFTNGP10.phx.gbl>
> <ujJqbTbIGHA.3752@.TK2MSFTNGP11.phx.gbl>
> microsoft.public.sqlserver.relationalserver.performance,microsoft.public.s
ql
> server.replication,microsoft.public.sqlserver.security,microsoft.public.sq
ls
> erver.securitytools
> microsoft.public.sqlserver.security:26245
> microsoft.public.sqlserver.securitytools:1079
> microsoft.public.sqlserver.relationalserver.performance:117
> like
> the
> name,
>|||is xp_cmdshell enabled on the subscriber?
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"asd" <asd@.asd.com> wrote in message
news:OrjMwdoIGHA.668@.TK2MSFTNGP11.phx.gbl...
> Both sa accounts have the same password. Whatever we try there are no
> results. We shall try to create a clean domain B installation and start
> from scratch. Maybe we shall have better luck this time.
> Still, any ideas and suggestions are welcome.
> BR,
> GAZ
>
> "Hilary Cotter" <hilary.cotter@.gmail.com> wrote in message
> news:%23s1N35bIGHA.3408@.TK2MSFTNGP12.phx.gbl...
>|||Yes. It can be executed and it works like a charm. We are just in the
process of setting up the new domain to try this from scratch. Let you all
know how it went.
BR,
GAZ
"Hilary Cotter" <hilary.cotter@.gmail.com> wrote in message
news:u0$K8BqIGHA.964@.tk2msftngp13.phx.gbl...
> is xp_cmdshell enabled on the subscriber?
> --
> Hilary Cotter
> Looking for a SQL Server replication book?
> http://www.nwsu.com/0974973602.html
> Looking for a FAQ on Indexing Services/SQL FTS
> http://www.indexserverfaq.com
> "asd" <asd@.asd.com> wrote in message
> news:OrjMwdoIGHA.668@.TK2MSFTNGP11.phx.gbl...
>|||We reinstalled the DomB and now everything works like clockworks. We haven't
the foggiest what the problem was but for now ignorance is a bliss. We'll
have to set up a new network soon with the same parameters and we'll keep a
keener eye on things.
Thanks everyone for your help.
GAZsql