Domain – Connecting to a share on a domain machine from a non-domain machine

Jon was on the right track with Kerberos, but didn't go into specifics.

On the server, you need to create a machine account. Hold on to the password.

You need to map your local account on your box with your account on the domain. From the command line:

ksetup /setrealm YOURDOMAIN.TLD
ksetup /addkdc YOURDOMAIN.TLD yourkdc.yourdomain.tld
ksetup /setmachpassword the-password-from-above
ksetup /mapuser yourdomainaccount@YOURDOMAIN.TLD yourlocalaccount

(the KDC in step two is usually the domain controller)

You can now access all Kerberised services, but your machine has not actually been joined to the domain.

I just solved the problem. I will summarize some notable aspects:

• Used a different login. Using name@domain schema. The permissions were not okay. It's actually a set of DFS shares.
• Re-Enabled the NAT. Some folders were still inaccessible from a different subnet.
• Created a stub zone (with forwarder to an A DNS server) for the remote domain (A) inside (B).
• Manually configured DNS suffixes. First the domain of the remote net (A) then the local (B)

Now hostnames, FQDN and IP can be used to access Red.

Update regarding the system error 2240

This is a separate Problem caused by the user account. The account has been configured to allow login only from specific Computers. It worked as soon as Blue's hostname was added to the user. This is done in the AD. See unrelated question Change list of allowed logon computers from batch file.