Active Directory Resource Pool Sync

[Jesse Schuchart]

Here is the senerio:

Client has 2 forests (contoso.com and NORTHWINDTRADERS.COM) using a 2003
Forest Trust.

The Resource Pool settings only allow 1 group to be defined. If the server
is setup in the domain dc1.contoso.com, it can see all of the resources
within a group in the contoso.com forest. However, it can not see the
resources in a group on dc1.NORTHWINDTRADERS.COM.

I have attempted to add the resource group from dc1.NORTHWINDTRADERS.COM
into a group on dc1.contoso.com. I get a partial fail, because during
syncronization, the server cannot access dc1.NORTHWINDTRADERS.COM
(specifically the error reads "The specified domain either does not exist or
could not be contacted.").

If the system is setup so that dc1.NORTHWINDTRADERS.COM and dc1.contoso.com
are using a 2000 Domain Trust, then the sync works. However, the client does
not want to manage the multiple trusts.

I have corrected this error my creating a new group for the
dc1.NORTHWINDTRADERS.COM users (PM's, Exec's, and Resource Managers). I then
specified each group as (e-mail address removed). The sync then works fine.

BUT....

What should I do so that the resources in dc1.NORTHWINDTRADERS.COM can be
accessed and loaded into the project server on dc1.contoso.com? Not like I
can just create another Active Directory Resource Pool Synchronization group,
because only 1 is defined. So now I have to work out a custom goup for that,
which will not be stored in the same place as the other resources.

So, my recommendation to MS is to allow more than 1 AD group to be defined
for each predefined group (such as Project Managers) and for the Resource
Pool. Another option is to re-write the AD sync screen so that the search is
not limited to the project server's active directory forest. This is
supposed to be ENTERPRISE Project Management, not FOREST Project Management
(sorry for the rant).

 

[NZ Projects]

You can't make omelette without breaking eggs, like you can't share cross
domain users without setting up trusts. What reason has your customer
provided for not wanting to create trusts ?

You could always use forms authentication which references each AD
directory, although this will not address your issue of sync groups.

 

[Jesse Schuchart]

They are on 2003 forest trusts, and do not want to manage domain level
trusts. Ah yeah, what can you do???

The point about the Resource Pool is still accurate though.