Block Trust between Child Domains Windows 2003

Posted on 2008-10-28
Medium Priority
Last Modified: 2009-03-01
We currently have a single forest.  We have a top level domain and a child domain.  We acquired another company but do not want any resources shared between both child domains.  My understanding with Windows server 2003 Active Directory, all trusts are implied and Transitive.  Is there a way to force the two child domains to "never" be able to share resources or see each other's AD objects?  Is there a knowledgebase article to verify this is possible?  Child domains can see resources in the parent domain but should not see the other child.
Question by:Shenook
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
LVL 30

Accepted Solution

LauraEHunterMVP earned 1500 total points
ID: 22826873
Nope. Forests are the security boundary. If you want to isolate the new company's environment, leave them as a separate forest and create an external trust relationship between their forest and the root domain of your existing forest.
LVL 14

Expert Comment

ID: 22826982
If you have DOMAIN.LOCAL and you create CHILD1.DOMAIN.LOCAL and CHILD2.DOMAIN.LOCAL there is NOT a trust relationship between CHILD1.DOMAIN.LOCAL and CHILD2.DOMAIN.LOCAL unless you create it.
LVL 30

Expert Comment

ID: 22827056
If all 3 domains are in the same forest, then that statement is 100% false.  There is a two-way transitive trust relationship between all domains within a single AD forest.
LVL 14

Expert Comment

ID: 22827286
I stand corrected. Transitive trusts do extend to all domains within the same forest.

Featured Post


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question