Browsing across domains

I have two different Windows 2000 Domains both in their own idependent active directory structures. Two of the domain controllers have to reside in the same subnet due to the fact that they both utlizize an ISA Server for publishing and Internet access.

The problem I am having is that I am able to browse either domain and access resources without having to do anything. This is not what I was wanting. I was wanting to only allow certain things to be accessed across domains, not everything being accessible by default. Does anyone know what I can do to stop this from happening? One of the servers has Terminal Services installed and I am not wanting users that are establishing sessions with this terminal server browsing across and going through things on the other domain.

thanks for any help you might can offer.

 

By default, Windows 2000 creates two-way transitive trusts. Check out this How to link for Configuring One-Way Non-Transitive Trusts in Windows 2000 (Q315053)

 

Both domains are in completely separate Active Directory Schemas, i.e. there are no trusts established between the two domains. I have verified this by going into Active Directory Domains and Trusts, looking at the properties page for the domain and examined the trust page in question.

I belive though, because both domains are residing on the same subnet, NETBIOS traffic is allowing cross domain browsing. I would have thought that you would have to enable this as you did in NT 4.0.

My setup is this:

Domain 1:
Windows 2000 Server acting as a file server / exchange server / web server. It is a domain controller for this domain. It sits on IP address 192.168.1.1. In this same domain is an Windows 2000 Server that is setup as a member server that is running ISA Server in order to act as the firewall and gateway to the internet, IP Address 192.168.1.5

Domain 2:
Windows 2000 Server acting as a file server / exchange server / web server. It is a domain controller for this domain. (completely separate active directory schema). It sits on IP Address 192.168.1.3. It was setup this way so that I could manually establish a trust relationship between this domain and the first domain so that it also could benefit from the ISA Server in the first domain (for website publishing and server publishing).

What is happening though, is that for some reason, when someone establishes a terminal services session with the domain controller of the second domain (this has been published via the ISA Server in the first domain), They are able to browse both domain1 and domain2 and see the resources on the workstations and isaserver of the first domain.

sorry for the lenghty post, but I belive that the more info I provide the better.

Thanks for any help.