iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A trusted domain relationship lets one Windows/Active Directory domain accept another domain’s authentication decisions for access across domains. It does not grant access by itself: the domain that owns the resource still checks the user’s permissions.
What “trusted” and “trusting” mean
In a cross-domain resource-access scenario, the domain that holds the user account is the trusted domain: it is the authentication authority. The domain that holds the server or other resource is the trusting domain: it accepts the trusted domain’s authentication decision. Microsoft describes this arrangement in its Windows Authentication Concepts documentation and protocol materials.
These labels describe the relationship from the resource-access scenario’s perspective. A domain can occupy different roles in different trust relationships.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How the relationship works
-
An administrator establishes the trust between the domains.
-
When a user from one domain requests a resource in the other, the resource domain can pass the authentication request to a domain controller in the account domain.
-
Domain controllers use trust-related secure-channel mechanisms to protect communications. Microsoft’s protocol specification explains that the trust establishment produces a shared trust password used to compute a session key for secure-channel traffic: [MS-NRPC]: Pass-Through Authentication and Domain Trusts.
-
The resource domain separately evaluates whether the authenticated identity is allowed to use the requested resource.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Authentication is not authorization
Authentication establishes who the user is; authorization determines what the user may do. A trust can let the resource domain accept an identity authenticated by another domain, but it does not automatically give that identity access to files, applications, or other resources. The resource’s permissions and access controls remain decisive. Microsoft explains the distinction in its authentication concepts documentation.
Rank #3
Trust direction and transitivity
Two separate properties describe a trust: its direction and whether it is transitive. Direction concerns which way authentication trust flows. Transitivity concerns whether the relationship can extend beyond the two directly connected domains. Microsoft covers these concepts in its domain trust direction protocol documentation.
| Property | Type | Meaning |
|---|---|---|
| Direction | One-way | Authentication trust is available in one direction. State which domain’s perspective you mean when describing it. |
| Direction | Two-way | Both domains trust one another for authentication operations. |
| Transitivity | Transitive | The trust may extend through other domains that the partners trust. |
| Transitivity | Nontransitive | The trust is limited to its two partners. |
Because direction terms depend on the point of view, avoid saying “inbound” or “outbound” without naming the domain you are describing.
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Why organizations monitor trust changes
Creating or removing a trust can be legitimate administrative work, particularly in organizations with multiple domains. It is also worth reviewing unexpected changes against approved administrative activity and the organization’s incident-response process. A Broadcom/Symantec reference on detecting trusted-domain changes treats unexpected activity as something that may warrant serious investigation; that guidance does not establish that every trust change is malicious or has the same risk.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
