- The Evolution of Directory Services
- Understanding the Development of AD DS
- AD DS Structure
- Outlining AD DS Components
- Understanding Domain Trusts
- Defining Organizational Units
- Outlining the Role of Groups in an AD DS Environment
- Understanding AD DS Replication
- Outlining the Role of DNS in AD DS
- Outlining AD DS Security
- Getting Familiar with AD DS Features in Windows Server 2016
- Summary
- Best Practices
This chapter is from the book
This chapter is from the book
This chapter is from the book
Understanding Domain Trusts
Domain trusts across forests used to require individual, explicitly defined trusts for each domain. This created an exponential trust relationship, which was difficult, to say the least, to manage. Windows Server 2003 and later versions took the trust relationship to a new level of functionality, with transitive trusts supplying automatic paths “up and down the forest tree.” These trusts are implicitly easier to understand and troubleshoot, and have greatly improved the manageability of Windows networks.
Conceptualizing Transitive Trusts
Two-way transitive trusts are automatically established upon the creation of a subdomain or with the addition of a domain tree into an AD DS forest. Transitive trusts are normally two-way, with each domain trusting the other domain. In other words, users in each domain can access resources such as printers or servers in the other domain if they are explicitly given rights in those domains. Bear in mind that just because two domains have a trust relationship does not mean that users from one domain can automatically access all the resources in the other domain; it is simply the first step in accessing those resources. The proper permissions still need to be applied.
Explicit Trusts
Explicit trusts are those that are set up manually, similar to the way that Windows NT trusts were constructed. A trust can be set up to join two unrelated domain trees into the same forest, for example. Explicit trusts are one-way, but two explicit trusts can be established to create a two-way trust. In Figure 4.5, an explicit trust has been established between the companyabc domain and the companyxyz domain to join them into the same forest structure.
)
FIGURE 4.5 Explicit trust between two domain trees.
When an explicit trust is set up to expedite the flow of trusts from one subdomain to another, it is known as a shortcut trust. Shortcut trusts simply allow authentication verifications to be processed faster, as opposed to having to move up and down a domain tree. In Figure 4.6, even though a transitive trust exists between the asia.companyabc.com and the europe.companyabc.com domains, a shortcut trust has been created to minimize authentication time for access between the two subdomains of this organization.
)
FIGURE 4.6 Shortcut trust between two subdomains in a forest.
Another possible use for explicit trusts is to allow connectivity between an AD DS forest and an external domain. These types of explicitly defined trusts are known as external trusts, and they allow different forests to share information without actually merging schema information or global catalogs.