2.

4
PLAN ACTIVE
DIRECTORY

Active
Directory
Trusts

TESTOUT SERVER PRO 2016:

IDENTITY
 Section Skill Overview
Create and manage Active Directory trusts.
Create a forest root trust.
Design trusts.
Create a shortcut trust.

TESTOUT SERVER PRO 2016:

IDENTITY
 Trusts
Trusts allow users to access resources in another domain.

I need access
to your share

Share User

Domain Corp
TESTOUT SERVER PRO 2016: Domain ACME
IDENTITY
 Trusts
Trusts allow users to access resources in another domain.
Trust options include:
One-way or two-way

Domain Corp trusts Domain ACME

Share User

Domain Corp
TESTOUT SERVER PRO 2016: Domain ACME
IDENTITY
 Trusts
Trusts allow users to access resources in another domain.
Trust options include:
One-way or two-way
Incoming or outgoing
Transitive and nontransitive
Domain Corp trusts Domain ACME

Outgoing Incoming
Trust Trust

Share User

Domain Corp
TESTOUT SERVER PRO 2016: Domain ACME
IDENTITY
 Trusts
Trusts allow users to access resources in another domain
Trust options include
One-way or two-way
Incoming or outgoing
Transitive A trusts B B trusts C
Nontransitive and C

Domain A Domain B Domain C

A trusts B B trusts C

Domain A Domain B Domain C

TESTOUT SERVER PRO 2016:
IDENTITY
 Types of Trusts
Automatic
Cross-forest
External
Realm
Shortcut

TESTOUT SERVER PRO 2016:

IDENTITY
 Automatic Transitive Trusts
CorpNet.com Forest

Created when a new domain Two-way Transitive

is added to a domain tree
or forest root domain.
CorpNet.com NetCorp.com
Two-way
Transitive

West.CorpNet.com
TESTOUT SERVER PRO 2016:
IDENTITY
 Cross-Forest Trusts
Are manual trusts created between two forests.
Must have a forest functional levels of Windows 2003 or higher.
Forest A Forest C

A C

B.A D.C

TESTOUT SERVER PRO 2016:

IDENTITY
 Active Directory Trusts
Are manual trusts created between two forests.
Must have a forest functional levels of Windows 2003 or higher.
Are nontransitive. No trust between
domains A and C

Forest A Forest B Forest C

A trusts B B trusts C

A B C

B.A C.A
TESTOUT SERVER PRO 2016:
IDENTITY
 Cross-Forest Trust Authentication
Forest-wide:
Permits unrestricted access by any users in the specified forest to all
available shared resources.
Enabled by default.
Selective:
Allows selected users and groups in remote forest to access resources
in local forest.
Must assign the Allowed to Authenticate right.

TESTOUT SERVER PRO 2016:

IDENTITY
 Cross-Forest Trust
Domain names are added to the Name Suffix Routing List at the
creation of the trust.
Domain names are removed to exempt a trust.
New domains added after the trust creation must be added
manually to the routing list.

TESTOUT SERVER PRO 2016:

IDENTITY
 External and Realm Trusts
External Trust
A nontransitive trust between domains in different forests
Forest A Forest C

A C

B.A D.C

TESTOUT SERVER PRO 2016:

IDENTITY
 External and Realm Trusts
External Trust
A nontransitive trust between domains in different forests
Realm Trust
A nontransitive trust between an Active Directory domain and a
Kerberos V5 realm.

TESTOUT SERVER PRO 2016:

IDENTITY
 Active Directory Trusts
Forest A
A transitive trust between domains
in the tree or forest.
Used to shorten the trust path.
Not required to traverse multiple trusts. A

B.A D.A

Shortcut Trust

C.B.A E.D.A
TESTOUT SERVER PRO 2016:
IDENTITY
 Summary
Trust Types
Automatic
Cross-forest
External
Realm
Shortcut

TESTOUT SERVER PRO 2016:

IDENTITY