Active Directory trust relationship step by step

A trust relationship is a logical link established between two domains. Between the two domains, one domain is called the trusting domain while the other is called the trusted domain. When a trust relationship is in place, the trusting domain honors the logon authentication of the trusted domain.

Generally, the trusted domain contains the users, while the trusting domain contains the resources. Therefore, users from the trusted domain will be able to access resources in the trusting domain because the users are trusted.

Trusts can be created automatically or manually. Trusts can also be classified as transitive and non-transitive. Transitive trust simply means that if Domain A trusts Domain B and Domain B trusts Domain C, then Domain A trusts Domain C.

Similarly with non-transitive trusts, if Domain A trusts Domain B and Domain B trusts Domain C, then Domain A does NOT trust Domain C. Also, trusts can be one-way or two-way. Different types of trusts described below are either one- or two-way by default.

Tree-root trust

A tree-root trust is implicitly established when you add a new tree root domain to a forest. The only domains that participate in the tree-root trust are those at the top of each of the trees. Tree-root trusts are two-way transitive trusts created automatically.

Parent-child trust

A parent-child trust relationship is implicitly established when you create a new child domain in a tree. The DCPromo process automatically creates a trust relationship between the new domain and the domain that immediately precedes it in the DNS namespace hierarchy. Parent-child trusts are two-way transitive trusts created automatically.

Shortcut trust

A shortcut trust must be explicitly created by a system administrator between two domains in the same forest. This type of trust is typically used in large forests where the administrator would manually create this type of trust to improve user logon time for those users that logon to computers in another domain within the forest. This type of trust is transitive and can be configured as one- or two-way.

External trust

An external trust must be explicitly created by a system administrator between two domains in different forests, or between a domain in an Active Directory forest and a Windows NT 4.0 or earlier domain. This trust is very useful when migrating resources from a Windows NT 4.0 domain to one within an Active Directory domain. This type of trust is non-transitive and can be one- or two-way.

Forest trust

A forest trust must be explicitly created by a systems administrator between two forest root domains (Windows 2003 and later). This trust allows for all domains in one forest to transitively trust all domains in another forest. However, this type of trust is not transitive over three or more forests. Forest trusts can be one-or two-way. Forest trusts are only available when the forest functional level is set to Windows Server 2003 or later.

Realm trust

A realm trust must be explicitly created by a systems administrator between a non-Windows Kerberos realm and a Windows 2003 or later domain. This type of trust can be transitive or non-transitive and one- or two-way.

The most important component in regards to trust relationships is the proper planning to ensure that users are provided with the access to resources that they require.

The trust relationship between two Active Directory drill bits / domains is a trusted link that allows authenticated users to access resources in another domain.

An approval relationship may be:

• Unidirectional: access to resources is only available in one direction (A) -> (B).
• Bidirectional: access to resources is available in both directions (A) <-> (B).
• Transitive: If (A) and (B) have a transitive trust relationship, if (B) approves a domain (C) it will be approved in (A).

In which case an approval relationship is required:

• Setting up a child domain.
• Takeover / merger of business to allow resource access.
• SI segmentation (geography / service / …).

In this tutorial, we will see how to set up a trust relationship between two forests as if we had just acquired a company.

Prerequisites

In order to be able to properly discuss the drills between them, it is necessary to set up a conditional forwarder on each DNS server.

Configure the trust relationship

The manipulations were performed on a domain controller on lab.intra.

Open the Active Directory Domain and Trust console, right-click on domain 1 and click Properties 2 .

Go to the Approvals tab 1 and click on New approval 2 to launch the wizard.

When launching the wizard, click Next 1 .

Indicate the domain 1 with which the trust relationship is made and click Next 2 .

Choose Approval Type: Forest Approval 1 and click Next 2 .

Configure the direction of approval, in the example we will choose Bidirectional direction 1 and click Next 2 to validate.

Choose the option This domain and the specified domain 1 , this allows to directly create the approval on the other domain. Click Next 1 .

Enter the identifiers 1 of an Administration account in the specified domain then click Next 2 .

Choose the Authentication option for all forest resources 1 and click Next 2 .

Authentication for all forest resources will allow users from both domains to log on to all available positions. If you want to set up a Selective Authentication, I invite you to read this article.

Also choose Authentication for all forest resources 1 for users from the local forest to the other forest and click Next 2 .

A summary of the trust relationship is displayed, click Next 1 to create the relationship.

The trust relationship has been created, click Next 1 .

Confirm outgoing and next approval by selecting Yes 1 and clicking Next 2 .

Click Finish 1 to close the wizard.

We see that the trust relationship has been created.

On a controller in the other forest, also verify that the relationship has been created.

Test the trust relationship

To validate the approval, we will do 2 tests:

• On a member post of the lab.intra domain, we will open a session with a user who is a member of the old.lan domain
• We will make a member of the domain lab.intra from a group of the domain old.lan

Log on to a post in another domain

On a computer in the lan.intra domain, change the user and enter the credentials of a user from the old.lan domain by specifying his domain in the identifier.

Once the session is open, launch a command prompt and enter SET, in the screenshot below we see that the computer is in the domain lab.intra 1 and that the user is a member of the old domain. lan.

Join a group in the trusted domain

Go to the properties of a user in the lab.intra domain to add it to a group. In the group selection window, click Locations 1 .

Choose the approved domain 1 and click OK 2 .

Select a group 1 and click OK 2 to add it to it.

The user is now part of a group in the trusted domain.