1

DomainA has a 2 way transitive trust with DomainB.
Users in both domains can successfully RDP into a TS server in DomainA.
DomainA users can launch Word, Visual Studio, etc. with no problems but when users in DomainB try they get screens popping up asking them to login, which they do, but then they get errors referring to TPM problems. They can launch a browser and go to outlook.office.com for email via OWA and it prompts them to login and they are successful doing that but they cannot launch Word or other O365 apps.
Any ideas?

4 Spice ups
2

Sounds like DomainB users aren’t properly replicating in DomainA as expected. I’d start by checking your DNS and Domain-Trust settings first.

3

If DNS or replication was bad they would not be able to RDP and login to DomainA’s server right?

1 Spice up
4

Depends on how ‘bad’ it is. But it’s a good place to start, double-check the entries are all correct and rule it out early.

1 Spice up
5

More info needed on your infrastructure, are you running Hybrid, is there ADSync and if so to which Domain. Are you trying to run applications from Domain A with users and devices registered in Domain B

1 Spice up
6

Hybrid, AD syncs with MS Entra Connect Sync for DomainA but DomainB is their own O365 tenant and I believe does the same.
Each domain has their own licenses but when DomainB users authenticate they are taken to their ADFS servers and MFA is triggered.

1 Spice up
7

Then given that scenario it seems Domain B ADSync/Replication might need some looking at as that’s where the constant authentication issues might be happening.

1 Spice up
8

login issues is that the user accounts from Domain B haven’t been successfully synchronized to Microsoft Entra ID. Ensure that Azure AD Connect is properly configured to synchronize users and groups from both Domain A and Domain B.

2nd Password Hash Sync, For users to sign in directly to Entra ID (and thus Office 365), Entra ID needs the password hashes for their accounts. Verify that password hash synchronization is enabled and functioning correctly in Azure AD Connect.
Another option, The DomainB not registered in Entra ID , it needs to be registered and verified within your Entra ID tenant. Check the domain registration status in the Entra ID portal.

2 Spice ups
9

I see some Attributes are not synced like “signInName” but do you have any recommendations? I didn’t set this up so I am not sure what we do need to sync to fix this.

1 Spice up
10

I ran the AAD Connect diags and PasswordHashSync is set to True.
The AD Connector Password Hash Sync - Status is true and up to date.

1 Spice up