domain and forest trusts

Posted on 2009-02-12
Last Modified: 2012-05-06
In forest A, parent domain A has child domain A1 and child domain A2.
In forest B, parent domain B exists.
child domain A1 and parent domain B have a two-way trust.
Can parent domain B access child domain A2?
Question by:ENTPF
    LVL 15

    Expert Comment

    I believe the answer is no, that the trusts between forests are not transitive.
    LVL 18

    Expert Comment

    It is correct, trust between separate forest is not transitive, regardless the type of trust you have established.
    LVL 57

    Accepted Solution

    In the current setup you would need a trust between parent domain B and child domain A2
    To the others, just  some discussion about the forest trust scenario
    "In a Windows Server 2003 forest, you can link two disjoined Windows Server 2003 forests together to form a one-way or two-way, transitive trust relationships. A two-way, forest trust is used to form a transitive trust relationship between every domain in both forests."

    Author Comment

    i believe the answer you guys gave is right provided the trusts used are external domain trusts between child domain A1 and parent domain B.  however, I believe forest trusts are transitive.  so if parent domain A and parent domain B had two way forest trusts instead, then child domain A1 and parent domain B would be accessible to each other.  see article and let me know if i am giving incorrect info:
    LVL 57

    Expert Comment

    by:Mike Kline
    Yeah that is why I asked my quesiton.  I don't think it was clear that you had a forest trust in place.
    LVL 18

    Assisted Solution

    Mike, thanks for the correction.
    I guess a part of my memory got lost some how.
    I must be thinking the the type of authentication(selective or domain-wide) etc in our enviornment which is mostly external trust.

    So, in this case, the answer is no, if you have external trust. If you use forest trust, then yes, your domain in forest B will be able to access domain in A2 assuming that you have forest trust at the root.

    I guess it would be a decision whether you can change the type of trust security wise.
    Just keep in mind that Forest trust is open transitively for new child domain added in the future and if domain-wide authentication is used, ti would be wide open by default that anyone can access any share resources that is opened to "authenticated users" or "everyone" group.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
    Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now