Error trying to configure trusted forest in IPAM

scenario

this lab experiment.  have created 2 single domain forests, abc , xyz.  both forests @ win2008r2 functionality both user server 2012r2 dcs.  have established 2 way transitive forest trust between abc , xyz.

in domain abc, have installed server 2016 machine , installed ipam.  have provisioned ipam server, opting gpo provisioning, , can manager dns servers , dhcp servers in abc domain.

problem

the reason deploying ipam on server 2016 want able manage multiple forests 1 ipam server.

i trying run following command:    invoke-ipamgpoprovisioning -domain xyz.local -gpoprefixname ipam1_ -force

if try , run command in powershell window running administrator@xyz.local, fails with:

invoke-ipamgpoprovisioning : failed add computer abcipam01.abc.local group ipamug. exception calling  "invoke" "2" argument(s): "the server unwilling process request. (exception hresult: 0x80072035)"  @ line:1 char:1  + invoke-ipamgpoprovisioning -domain xyz.local -gpoprefixname ipam1_ ...  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~      + categoryinfo          : invalidoperation: (:) [invoke-ipamgpoprovisioning], exception      + fullyqualifiederrorid : invalidoperation,invoke-ipamgpoprovisioning

just thorough, added administrator@xyz.local administrators, ipam administrators , remote desktop users groups on ipam server, logged on server administrator@xyz.local, opened elevated powershell window , tried again , got same result.

according page https://technet.microsoft.com/en-gb/windows-server-docs/networking/technologies/ipam/manage-resources-in-multiple-active-directory-forests i'm doing things in correct manner isn't working.

any appreciated.

sorted myself.

after thinking it, occurred me trying admin-level stuff in 2 domains using account had admin rights in 1 domain or other.  adding administrator@abc.local administrators group in xyz.local allowed me create ipam gpos.

obviously, solution fine use in a lab/dev environment but not best practice production environment.

mike

Windows Server  >  IPAM, DHCP, DNS