It's not listing from all the domains. It IS trying to reach the other controllers. The problem is that there's no route to some of the servers and others there's no route back to the machine. Doing a tcpdump yields the following
From my samba machine in the DMZ to, and back from, the local AD server:
Quote:
10:45:01.170297 IP 10.xxx.xx.34.44697 > 10.xxx.x.70.389: tcp 0
10:45:01.170434 IP 10.xxx.x.70.389 > 10.xxx.xx.34.44697: tcp 1188
To other AD servers with insufficient routing:
Quote:
10:47:00.154323 IP 10.xxx.xx.34 > 10.xx.xxx.128 tcp 99
10:47:10.462745 IP 10.xxx.xx.34 > 10.x.xx.223 tcp 99
There are 5 or so more remote AD servers from other domains that never come back for due to routing. During the time that it's attempting to query or connect with these servers file listings and such "hang" until the the local machine gives up.
Using the
allow trusted domains = no parameter DOES limit the connection attempts to once every half an hour or so. Before that, it would try almost every time a directory listing or anything else that needed to tie a user name to an UID was attempted. It's not the fix, but it SURE helped.
The routing is something that will not be fixed. The other domains need not access nor communicate with our DMZ.