Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Block Trust between Child Domains Windows 2003

Posted on 2008-10-28
4
Medium Priority
?
374 Views
Last Modified: 2009-03-01
We currently have a single forest.  We have a top level domain and a child domain.  We acquired another company but do not want any resources shared between both child domains.  My understanding with Windows server 2003 Active Directory, all trusts are implied and Transitive.  Is there a way to force the two child domains to "never" be able to share resources or see each other's AD objects?  Is there a knowledgebase article to verify this is possible?  Child domains can see resources in the parent domain but should not see the other child.
0
Comment
Question by:Shenook
  • 2
  • 2
4 Comments
 
LVL 30

Accepted Solution

by:
LauraEHunterMVP earned 1500 total points
ID: 22826873
Nope. Forests are the security boundary. If you want to isolate the new company's environment, leave them as a separate forest and create an external trust relationship between their forest and the root domain of your existing forest.
0
 
LVL 14

Expert Comment

by:dfxdeimos
ID: 22826982
If you have DOMAIN.LOCAL and you create CHILD1.DOMAIN.LOCAL and CHILD2.DOMAIN.LOCAL there is NOT a trust relationship between CHILD1.DOMAIN.LOCAL and CHILD2.DOMAIN.LOCAL unless you create it.
0
 
LVL 30

Expert Comment

by:LauraEHunterMVP
ID: 22827056
If all 3 domains are in the same forest, then that statement is 100% false.  There is a two-way transitive trust relationship between all domains within a single AD forest.
0
 
LVL 14

Expert Comment

by:dfxdeimos
ID: 22827286
I stand corrected. Transitive trusts do extend to all domains within the same forest.
0

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
I’m willing to make a bet that your organization stores sensitive data in your Windows File Servers; files and folders that you really don’t want making it into the wrong hands.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

571 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question