Domain Unreachable (#424) Error when Accessing Orchestrator from Another Domain

News Knowledge Base
,
1

Why does Windows Authentication fail with a 'Domain Unreachable (#424)' error when accessing Orchestrator from another domain?

Issue Description:

Orchestrator is hosted in Domain A, and users in Domain B access it using Windows Authentication. However, they are now encountering a Domain Unreachable (#424) error. This typically occurs when the Orchestrator Application Pool user (or the Orchestrator server itself) can no longer communicate with the Active Directory (AD) domain controller in Domain B.

Resolution Steps

1. Recommended Long-Term Solution: Establish a Forest Trust Between Domains

To enable seamless and scalable Windows Authentication across domains, it is recommended to configure a Forest Trust between Domain A and Domain B.

Steps to check and create a Forest Trust:

Check Existing Trust Type:

  1. On a Domain Controller in Domain A or Domain B, open Active Directory Domains and Trusts.

  2. Right-click your domain and select Properties.

  3. Navigate to the Trusts tab and verify if a trust exists with the other domain and its type (External Trust or Forest Trust).

Create a Forest Trust (if needed):

  1. In Active Directory Domains and Trusts, right-click your domain, select Properties, then go to the Trusts tab.

  2. Click New Trust and follow the wizard steps:

      • Specify the domain name of the other forest.

      • Choose Forest Trust as the trust type.

      • Select the trust direction (typically Two-way for cross-domain authentication).

      • Complete the wizard and validate the trust.

Verify and Test:

  1. After establishing the forest trust, test Windows Authentication by accessing Orchestrator from Domain B.

  2. If authentication is successful, any Credential Manager entries used as a temporary workaround can be removed.

2. Workaround: Add Domain A User Credentials in Credential Manager

If immediate access is required and configuring a forest trust is not feasible, adding Domain A user credentials manually on Domain B client machines can resolve the authentication issue.

To add credentials in Credential Manager:

  1. Press Win + R, type control, and press Enter to open Control Panel.

  2. Navigate to User Accounts > Credential Manager.

  3. Select Windows Credentials, then click Add a Windows credential.

  4. Enter the fully qualified domain name (FQDN) of the Orchestrator server (e.g., orchestrator.domainA.com) in the Internet or network address field.

  5. Enter the Domain A username (DomainA\username) and password.

  6. Click OK to save.

  7. Open a browser and access Orchestrator to verify Windows Authentication is working.

Conclusion:

Configuring a Forest Trust between the domains is the recommended long-term solution to ensure seamless and reliable Windows Authentication across domains. Meanwhile, adding credentials in Credential Manager can serve as a temporary workaround to restore access quickly. Implementing the forest trust will help avoid recurring authentication issues and simplify user management.