How can I resolve the IPAM cross-domain permission issue ?

Question

How can I resolve the IPAM cross-domain permission issue ?

Vincent Keung Koh 20

I’m encountering an issue while executing Provision-IpamServer. The command fails to deploy the required GPOs in child domains within our multi-domain forest and returns an Access Denied error.

Could you please guide me on how to assign cross-domain management permissions for the IPAM service accounts so that the provisioning can complete successfully ?

0 comments

2 answers

Your answer

Answer 1

Hello Vincent Keung Koh,

The Access Denied error during Provision-IpamServer in a multi‑domain forest is caused by the IPAM service account lacking rights to create and link the required GPOs in child domains. By default, IPAM provisioning attempts to deploy three GPOs (IPAM1, IPAM2, IPAM3) into each domain where managed servers reside. To succeed across domains, you must explicitly delegate permissions. In each child domain, grant the IPAM provisioning account membership in Domain Admins or, at minimum, assign it rights to create and link GPOs. This can be done by opening Group Policy Management in the child domain, right‑clicking the domain node, and using “Delegate Control” to add the IPAM account with “Create GPOs and link them” permission.

Additionally, ensure that the IPAM server has Kerberos trust visibility into the child domains. If the forest trust is in place but selective authentication is enabled, you must allow the IPAM account to authenticate to domain controllers in those domains. Once the account has the correct delegation, rerun Provision-IpamServer and the GPO creation will complete successfully. This is the supported method to enable cross‑domain IPAM provisioning without bypassing security boundaries.

If my answer is useful for you, please hit Accept the answer to support me.

Thank you,

HL.

Answer 2

For IPAM to manage servers in child or other domains, the required permissions are assigned through IPAM GPO provisioning in each managed domain.

Verify the forest relationship.
- For remote Active Directory forests, each forest that IPAM manages must have a two-way trust with the forest where IPAM is installed.
Run GPO provisioning for every managed domain.
- If managed servers are provisioned by using Group Policy, the corresponding GPOs must be created in every managed domain by using Invoke-IpamGpoProvisioning.
- The GpoPrefixName value must match the prefix configured in the IPAM provisioning wizard.
Run the cmdlet from the IPAM server.
- In a cross-forest scenario, Group Policy-based provisioning must be run on the IPAM server, not on the trusting domain controllers.
Use an account with the required rights in the target domain.
- Invoke-IpamGpoProvisioning requires Domain Admin privileges in the target domain to create the GPOs.
- In the cross-forest example, membership in the target forest’s Domain Admins group is required.
Use the target domain explicitly.
- Example:

Invoke-IpamGpoProvisioning -Domain "child.contoso.com" -GpoPrefixName "IPAM1" -Force

If the IPAM server computer account must be specified explicitly:

Invoke-IpamGpoProvisioning -Domain "child.contoso.com" -GpoPrefixName "IPAM2" -IpamServerFqdn "Ipam2.Contoso.com" -Force

If a specific domain controller in the child domain should perform GPO creation:

Invoke-IpamGpoProvisioning -Domain "child.contoso.com" -GpoPrefixName "IPAM1" -DomainController "dc1.child.contoso.com" -Force

Understand what the cmdlet grants automatically.
- It creates and links three GPOs with suffixes _DHCP, _DNS, and _DC_NPS.
- It creates the universal group IPAMUG in the target domain if it does not already exist.
- It adds the IPAM server computer account to IPAMUG.
- It modifies the domain-wide DNS ACL to enable DNS RPC access for IPAMUG.
Delegate ongoing GPO editing if needed.
- After initial creation by a Domain Admin, GPO editing privileges can be delegated with -DelegatedGpoUser or -DelegatedGpoGroup.
- Example:

Invoke-IpamGpoProvisioning -Domain "child.contoso.com" -GpoPrefixName "IPAM1" -DelegatedGpoGroup "IPAMAdmins" -Force

If Provision-IpamServer is failing with Access Denied in child domains, the supported fix is to complete IPAM server provisioning and then run Invoke-IpamGpoProvisioning separately for each child domain using Domain Admin rights in that domain. That is the step that assigns the cross-domain access required for IPAM data collection and management.

References: