Ad Trust 2h3o3y

In Active Directory, when two domains trust each other or a trust relationship exists between the domains, the s and computers in one domain can access resources residing in the other domain. The trust relationships ed in Windows Server 2003 are summarized below: The characteristics of Windows Server 2003 trusts are outlined below: 

Trusts can be nontransitive or transitive: o Transitive trusts: With transitive trusts, trust is applicable for each trusted domain. What this means is where Domain1 trusts Domain2, and Domain2 trusts Domain3; Domain1 would also trust Domain3. o Nontransitive trust: The defined trust relationship ends with the two domains between which the particular trust is created.



Trusts can be one-way or two-way trusts: o One-way trusts: Based on the direction of the trust, one-way trust can further be broken into either incoming trust or outgoing trusts. One way trust can be transitive or nontransitive: 

Incoming Trust: With incoming trust, the trust is created in the trusted domain, and s in the trusted domain are able to access network resources in the trusting domain or other domain. s in the other domain cannot however access network resources in the trusted domain.



Outgoing Trust: In this case, s in the other domain able to access network resources in the initiating domain. s in the initiating domain are not able to access any resources in the other domain.

o Two-way trusts: A two-way trust relationship means that where Domain1 trusts Domain2, then Domain2 trusts Domain1. The trust basically works both ways, and s in each domain are able to access network resources in eitherone of the dolmans. A two-way, transitive trust relationship is the trust that exists between parent domains and child domains in a domain tree. In two-way transitive trust, where Domain1 trusts Domain2 and Domain2 trusts Domain3, then Domain1 would trust Domain3 and Domain3 would trust Domain1.Two-way, transitive trust is the default trust

relationship between domains in a tree. It is automatically created and exists between top-level domains in a forest. 

Trusts can be implicit or explicit trusts: o Implicit: Automatically created trust relationships are called implicit trust. An example of implicit trust is the two-way, transitive trust relationship that Active Directory creates between a parent and child domains. o Explicit: Manually created trust relationships are referred to as explicit trust.

Types of Active Directory Trust Relationships 

Parent/Child trust: A parent/child trust relationship exists between two domains in Active Directory that have a common contiguous DNS namespace, and who belong to the identical forest. This trust relationship is established when a child domain is created in a domain tree.



Tree Root trust: A tree root trust relationship can be configured between root domains in the same forest. The root domains do not have a common DNS namespace. This trust relationship is established when a new tree root domain is added to a forest.



Shortcut trust: This trust relationship can be configured between two domains in different domain trees but within the same forest. Shortcut trust is typically utilized to improve logon times.



External trust: External trust relationships are created between an Active Directory domain and a Windows NT4 domain.



Realm trust: A realm trust relationship exists between an Active Directory domain and a non-Windows Kerberos realm.



Forest trust: Forest trust can be created between two Active Directory forests.

 Tree-root trust and Parent-child trust is implicitly created by Active Directory when new domains are created. What this means is that you do not need to explicitly create these trusts, nor do you have to perform any configuration or management tasks for the trust relationships. 

Shortcut trust, Realm trust, External trust and Forest trust differ to Treeroot and Parent-child trust, in that the former four trusts have to be explicitly created and managed. Because of the different types of trust relationships that can be created, you need to plan which type of trust relationship to create for the domains within your Active Directory environment.

 Shortcut Trust 

Before you can create any shortcut trusts, you must be a member of the Enterprise or Domain groups in each domain in the forest. Another requirement is that the domains you are creating shortcut trust for, are Windows Server 2003 domains that reside in the same forest. As mentioned earlier, Shortcut trust is usually created to speed up authentication between two domains in different trees but within the same forest.



Shortcut trust can be one-way transitive trust, or two-way transitive trust. What shortcut trust essentially does is it shortens the trust path traversed for authentication requests made between domains of different trees. Shortcut trust is typically configured in an intricate forest where s

continually need to access resources of domains belonging to different trees. Shortcut trust improves query response performance as well. 

· You would need to create one-way shortcut trust when the optimized tust path is only needed for one of the domains in the trust. The other domain's s would need to transverse the full trust path when handling authentication requests. You would need to create twoway shortcut trust when the s in each domain need to use the shortened trust path for authentication requests.



The Active Directory tool that you use to create shortcut trust is the Active Directory Domains and Trusts console. The console enables you to specify selective authentication for incoming shortcut trust and outgoing shortcut trust. What this means is that you can set authentication differently for the two forms of trust. When you set selective authentication for incoming shortcut trust, you would need to specify permissions for every resource that s in the other domain should be able to access. If domain wide authentication is specified on the incoming shortcut trust, s in the other domain and s in the local domain have the identical permissions to network resources.

 Realm Trust 

In order to create realm trust, you should have Enterprise or Domain permissions for the Windows Server 2003 domain, and you should have the permissions required for the non-Windows Kerberos version 5 realm. You would typically create realm trust to enable trust between a Windows Server 2003 domain and a MIT or UNIX v5 Kerberos realm. You can create Realm trust as either transitive or nontransitive trust, and as either be one-way trust or two-way.

 External Trust 

You need to be a member of Enterprise s or Domain s of the Windows Server 2003 domain and you need to be a member Enterprise s or Domain s of the other domain, to create one-way External trust or two-way External trust.



Recall from an earlier discussion, that External trust is always nontransitive in nature, and is typically used to enable trust between an Active Directory domain and a down-level Windows NT 4 domain. When the External trust is created, security principals (s, Groups, Computers) from the external domain are able to access network resources in the internal domain (Windows Server 2003 domain). The foreign security principals can be examined in the Active Directory s And Computers console. The only requirement is that Advanced Features are enabled. You can explicitly define different authentication for incoming External trusts and outgoing External trusts.

 Forest Trust 

You need to belong to the Enterprise s groups in each forest that you want to create forest trust between. In addition to this, the domains within each forest and each particular forest have to be raised to the Windows Server 2003 functional level.



Forest trust is typically created when enterprises merge or takeovers occur, and each company within the enterprise still needs to maintain some form of istrative independence. This trust relationship enables s to access Active Directory objects between all domains impacted by the particular forest trust relationship. Forest trust is transitive, and can be one-way or two-way trust. You would create one-way Forest trusts when s in the trusted forest need to access Active Directory objects in the trusting forest, but those s in the trusting forest do not need to access resources in the trusted forest. You would create two-way Forest trust in cases where s in either one of the forests need to access resources hosted in the other forest.