---
description: Idea of Trust Relationship ?
---

# AD Domains Trust Relationship

## <mark style="background-color:blue;">What Are AD Trust Relationship</mark>

> <mark style="background-color:blue;">Active Directory (AD) trust relationships are mechanisms that enable users, computers, or services in one AD domain to access resources in another domain or forest within a Microsoft Windows environment. They establish a secure communication channel between domains or forests, allowing authentication and authorization across organizational boundaries.</mark>

## <mark style="background-color:blue;">**Key Terms**</mark>

* <mark style="color:blue;">**Trusted Domain**</mark><mark style="color:blue;">:</mark> The domain whose users or accounts are trusted to authenticate and access resources in another domain.
* <mark style="color:blue;">**Trusting Domain**</mark><mark style="color:blue;">:</mark> The domain that allows users from the trusted domain to access its resources.
* <mark style="color:blue;">**Direction**</mark><mark style="color:blue;">:</mark> Specifies the flow of trust, determining which domain trusts the other for authentication.

## <mark style="background-color:blue;">Types of Trusts</mark>

> _<mark style="background-color:blue;">**There are several types of trusts, including:**</mark>_

1. <mark style="background-color:blue;">**One-Way Trust**</mark>

<mark style="color:blue;">**Definition**</mark><mark style="color:blue;">:</mark> **A one-way trust is a unidirectional relationship where one domain (the trusting domain) allows users from another domain (the trusted domain) to authenticate and access its resources, but not vice versa.**

<mark style="color:blue;">**Characteristics:**</mark>

* <mark style="background-color:blue;">**Direction**</mark>: **Unidirectional. The trusting domain grants access to its resources, but the trusted domain does not reciprocate.**
* <mark style="background-color:blue;">**Authentication**</mark><mark style="background-color:blue;">:</mark> **Users in the trusted domain can authenticate to resources in the trusting domain, provided they have appropriate permissions.**
* <mark style="background-color:blue;">**Scope**</mark><mark style="background-color:blue;">:</mark> **Can be established between domains in the same forest or different forests.**
* <mark style="background-color:blue;">**Transitivity**</mark><mark style="background-color:blue;">:</mark> **Can be transitive or non-transitive, depending on the trust type (forest trust vs. external trust).**
* <mark style="background-color:blue;">**Transitive Trust: A trust where, if Domain A trusts Domain B and Domain B trusts Domain C, then Domain A automatically trusts Domain C. The trust propagates through the chain of trusted domains.**</mark>

<mark style="color:blue;">**Use Case**</mark><mark style="color:blue;">:</mark>

* A vendor (<mark style="color:blue;">**vendor.com**</mark>) needs access to a specific file share in a client’s domain (<mark style="color:blue;">**client.com**</mark>) for a project, but the client does not need access to the vendor’s resources.
* A one-way trust from <mark style="color:blue;">**client.com**</mark> to <mark style="color:blue;">**vendor.com**</mark> allows vendor employees to authenticate and access the file share.

<mark style="color:blue;">**Example**</mark><mark style="color:blue;">:</mark>

* Company A (_<mark style="color:blue;">`companyA.com`</mark>_) trusts Company B (_<mark style="color:blue;">`companyB.com`</mark>_). Users in companyB.com can access resources in companyA.com, but users in _<mark style="color:blue;">`companyA.com`</mark>_ cannot access resources in _<mark style="color:blue;">`companyB.com`</mark>_ unless another trust is created.
* Common in scenarios where a partner organization needs access to specific resources without reciprocal access.



2. <mark style="background-color:blue;">**Two-Way Trust**</mark>

<mark style="color:blue;">**Definition:**</mark> **A two-way trust is a bidirectional relationship where both domains trust each other, allowing users in either domain to authenticate and access resources in the other, assuming appropriate permissions.**

<mark style="color:blue;">**Characteristics:**</mark>

* <mark style="background-color:blue;">**Direction:**</mark> Bidirectional. Each domain is both a trusting and trusted domain for the other.
* <mark style="background-color:blue;">**Authentication:**</mark> Users in either domain can authenticate to resources in the other domai&#x6E;**.**
* <mark style="background-color:blue;">**Scope:**</mark> Common in parent-child trusts or tree-root trusts within a forest, but can also be external or forest trusts between different forests.
* <mark style="background-color:blue;">**Transitivity:**</mark> Can be transitive or non-transitive, depending on the trust type.

<mark style="color:blue;">**Example:**</mark>

* _<mark style="color:blue;">**`companyA.com`**</mark>_ and _<mark style="color:blue;">**`companyB.com`**</mark>_ establish a _<mark style="color:blue;">**`two-way trust`**</mark>_. Employees in _<mark style="color:blue;">**`companyA.com`**</mark>_ can access resources in _<mark style="color:blue;">**`companyB.com`**</mark>_, and vice versa, based on permissions.
* Common in merged organizations or closely collaborating departments.

<mark style="color:blue;">**Use Case:**</mark>

* Two subsidiaries of a parent company (_<mark style="color:blue;">**`sales.contoso.com`**</mark>_ and _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_) need to share resources like file servers and databases. A two-way trust allows seamless access for users in both domains.



3. <mark style="background-color:blue;">**Transitive Trust**</mark>

<mark style="color:blue;">**Definition:**</mark>**&#x20;A transitive trust extends beyond the directly trusted domains to include other domains in the same forest or tree, creating a chain of trust relationships.**

<mark style="color:blue;">**Characteristics**</mark><mark style="color:blue;">:</mark>

* <mark style="background-color:blue;">**Transitivity:**</mark> If Domain A trusts Domain B, and Domain B trusts Domain C, then Domain A trusts Domain C.
* <mark style="background-color:blue;">**Direction:**</mark> Can be one-way or two-way.
* <mark style="background-color:blue;">**Scope:**</mark> Typically applies to trusts within a forest (parent-child, tree-root) or forest trusts between forests.
* <mark style="background-color:blue;">**Automatic Creation:**</mark> Parent-child and tree-root trusts in a forest are transitive by default.

<mark style="color:blue;">**Example:**</mark>

* In a forest with domains _<mark style="color:blue;">**`contoso.com`**</mark>_, _<mark style="color:blue;">**`sales.contoso.com`**</mark>_, and _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_, a parent-child trust between _<mark style="color:blue;">**`contoso.com`**</mark>_ and _<mark style="color:blue;">**`sales.contoso.com`**</mark>_, and another between _<mark style="color:blue;">**`contoso.com`**</mark>_ and _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_, _<mark style="color:blue;">**`makes sales.contoso.com`**</mark>_ and _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_ trust each other transitively through the forest root (_<mark style="color:blue;">**`contoso.com`**</mark>_).

<mark style="color:blue;">**Use Case:**</mark>

* A large organization with multiple child domains (_<mark style="color:blue;">**`europe.contoso.com`**</mark>_, _<mark style="color:blue;">**`asia.contoso.com`**</mark>_) uses transitive trusts to allow users in any domain to access resources in other domains within the same forest without creating additional trusts.



4. <mark style="background-color:blue;">**Non-Transitive Trust**</mark>

<mark style="color:blue;">**Definition:**</mark>**&#x20;A non-transitive trust is limited to the two domains directly involved in the trust relationship and does not extend to other domains**.

<mark style="color:blue;">**Characteristics**</mark><mark style="color:blue;">:</mark>

* <mark style="background-color:blue;">**Transitivity**</mark>: Non-transitive. If Domain A trusts Domain B, and Domain B trusts Domain C, Domain A does _not_ trust Domain C.\
  &#xNAN;_<mark style="background-color:blue;">**A non-transitive trust does not propagate beyond the two domains directly involved. If Domain A trusts Domain B, and Domain B trusts Domain C, Domain A does not automatically trust Domain C.**</mark>_
* <mark style="background-color:blue;">**Direction:**</mark> Can be one-way or two-way.
* <mark style="background-color:blue;">**Scope:**</mark> Typically used for external trusts between domains in different forests or with non-AD domains (Windows NT 4.0 domains).

<mark style="color:blue;">**Example:**</mark>

* _<mark style="color:blue;">**`companyA.com`**</mark>_ (in Forest A) establishes a non-transitive external trust with _<mark style="color:blue;">**`partner.com`**</mark>_ (in Forest B). This trust allows _<mark style="color:blue;">**`companyA.com`**</mark>_ users to access resources in _<mark style="color:blue;">**`partner.com`**</mark>_, but does not extend to other domains in Forest B, such as _<mark style="color:blue;">**`sales.partner.com`**</mark>_.

<mark style="color:blue;">**Use Case:**</mark>

* A company (_<mark style="color:blue;">**`companyA.com`**</mark>_) partners with an external organization (_<mark style="color:blue;">**`partner.com`**</mark>_) and needs access to a specific application in _<mark style="color:blue;">**`partner.com`**</mark>_. A non-transitive trust ensures that only _<mark style="color:blue;">**`partner.com`**</mark>_ is accessible, not other domains in its forest.



5. <mark style="background-color:blue;">**Forest Trust**</mark>

<mark style="color:blue;">**Definition:**</mark> **A forest trust is a transitive trust between the root domains of two AD forests, allowing resource sharing and authentication across all domains in both forests.**

<mark style="color:blue;">**Characteristics:**</mark>

* <mark style="background-color:blue;">**Transitivity**</mark><mark style="background-color:blue;">:</mark> Transitive, extending to all domains in both forests.
* <mark style="background-color:blue;">**Direction:**</mark> Can be one-way or two-way.
* <mark style="background-color:blue;">**Scope:**</mark> Connects entire forests, ideal for large-scale collaboration.
* <mark style="background-color:blue;">**Requirements:**</mark> Both forests must be at Windows Server 2003 forest functional level or higher. DNS resolution (conditional forwarders) is critical.

<mark style="color:blue;">**Example:**</mark>

* Forest A (_<mark style="color:blue;">**`contoso.com`**</mark>_) and Forest B (_<mark style="color:blue;">**`fabrikam.com`**</mark>_) establish a two-way forest trust. Users in any domain in contoso.com (_<mark style="color:blue;">**`sales.contoso.com`**</mark>_) can access resources in any domain in _<mark style="color:blue;">**`fabrikam.com`**</mark>_ (_<mark style="color:blue;">**`marketing.fabrikam.com`**</mark>_), and vice versa.

<mark style="color:blue;">**Use Case:**</mark>

* After a merger, two companies (_<mark style="color:blue;">**`contoso.com and fabrikam.com`**</mark>_) create a forest trust to enable employees to access shared resources like email systems or file servers across both forests.



6. **Shortcut Trust**

<mark style="color:blue;">**Definition:**</mark> **A shortcut trust is a manually created transitive trust between two domains in the same forest to optimize authentication performance by bypassing the default trust path through the forest root.**

<mark style="color:blue;">**Characteristics:**</mark>

* <mark style="background-color:blue;">**Transitivity**</mark>: Transitive within the forest.
* <mark style="background-color:blue;">**Direction**</mark><mark style="background-color:blue;">:</mark> Can be one-way or two-way.
* <mark style="background-color:blue;">**Scope**</mark><mark style="background-color:blue;">:</mark> Used within a single forest to improve authentication efficiency.
* <mark style="background-color:blue;">**Purpose**</mark><mark style="background-color:blue;">:</mark> Reduces latency in environments with deep domain hierarchies or frequent cross-domain access.

<mark style="color:blue;">**Example:**</mark>

* In a forest with _<mark style="color:blue;">**`contoso.com`**</mark>_ (root), _<mark style="color:blue;">**`sales.contoso.com`**</mark>_, and _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_, authentication between _<mark style="color:blue;">**`sales.contoso.com`**</mark>_ and _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_ normally traverses _<mark style="color:blue;">**`contoso.com.`**</mark>_ A shortcut trust directly between _<mark style="color:blue;">**`sales.contoso.com`**</mark>_ and _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_ reduces the trust path.

<mark style="color:blue;">**Use Case:**</mark>

* Employees in _<mark style="color:blue;">**`sales.contoso.com`**</mark>_ frequently access a database in _<mark style="color:blue;">**`marketing.contoso.com`**</mark>_. A shortcut trust minimizes authentication delays, improving user experience.



8. <mark style="background-color:blue;">**Comparison of Trust Types**</mark>

| <mark style="background-color:blue;">**Trust Type**</mark> | <mark style="background-color:blue;">**Transitivity**</mark> | <mark style="background-color:blue;">**Direction**</mark> | <mark style="background-color:blue;">**Scope**</mark> | <mark style="background-color:blue;">**Common Use Case**</mark> |
| ---------------------------------------------------------- | ------------------------------------------------------------ | --------------------------------------------------------- | ----------------------------------------------------- | --------------------------------------------------------------- |
| One-Way Trust                                              | Varies                                                       | Unidirectional                                            | Same or different forests                             | Partner access to specific resources                            |
| Two-Way Trust                                              | Varies                                                       | Bidirectional                                             | Same or different forests                             | Mutual resource sharing between domains                         |
| Transitive Trust                                           | Transitive                                                   | One-way or Two-way                                        | Within or across forests                              | Resource access across multiple domains in a forest             |
| Non-Transitive Trust                                       | Non-transitive                                               | One-way or Two-way                                        | Between specific domains                              | Limited access to a single external domain                      |
| Forest Trust                                               | Transitive                                                   | One-way or Two-way                                        | Between forest roots                                  | Collaboration across entire forests                             |
| Shortcut Trust                                             | Transitive                                                   | One-way or Two-way                                        | Within a forest                                       | Optimize authentication in complex forests                      |



## Inbound and Outbount Trust RelationShip&#x20;

### _<mark style="background-color:blue;">**Inbound Trust Relationship**</mark>_

* _<mark style="background-color:blue;">**Definition:**</mark>_ An inbound trust means that the domain you are configuring (the trusting domain) allows users from another domain (the trusted domain) to authenticate and access its resources.
* _<mark style="background-color:blue;">**Direction:**</mark>_ The trust "comes in" to your domain, meaning your domain trusts the other domain to authenticate its users.
* _<mark style="background-color:blue;">**Example:**</mark>_ If Domain A has an inbound trust with Domain B, users from Domain B can access resources in Domain A. Domain A trusts Domain B's authentication.
* _<mark style="background-color:blue;">**Key Point:**</mark>_ The trusting domain (Domain A) relies on the trusted domain (Domain B) to verify user identities.

### _<mark style="background-color:blue;">**Outbound Trust Relationship**</mark>_

* _<mark style="background-color:blue;">**Definition:**</mark>_ An outbound trust means that the domain you are configuring (the trusted domain) allows its users to authenticate and access resources in another domain (the trusting domain).
* _<mark style="background-color:blue;">**Direction:**</mark>_ The trust "goes out" from your domain, meaning your domain's users can access resources in the other domain.
* _<mark style="background-color:blue;">**Example:**</mark>_ If Domain A has an outbound trust with Domain B, users in Domain A can access resources in Domain B, provided Domain B has a corresponding inbound trust.
* _<mark style="background-color:blue;">**Key Point:**</mark>_ The trusted domain (Domain A) is responsible for authenticating its users, and the trusting domain (Domain B) grants access based on that authentication.
