Windows Server - trust relationship

What is a trust relationship?

Trust relationships authenticate users between domains

Trust relationships (trusts) are authentication pipelines between different domains. Some trusts are generated automatically as part of the domain installation process, and others are trusts that you create manually for various reasons. Trust relationships form the framework that allows resource sharing between domains, and they also provide the structure that supports authentication between domains. The main purpose of a trust relationship is to provide a user in one domain access to a resource in another domain without needing a user account in both domains.

There are trusting and trusted entities

In any trust relationship, there are two parties involved: the trusting entity and the trusted entity. The trusting entity is the resource holding entity, whereas the trusted entity is the account holding entity. For example, if you lend someone your laptop, you trust them. You are the resource holding entity. They are the account holding entity.

Just because there is a trust between domains that does not necessarily mean that someone from a different domain has access to resources in other domains. Administrators must grant users the rights to resources. By default, there are no user rights.

Parent-Child and Tree-Root trusts

Some trusts are automatically created

Windows Server supports several different trusts for use in different situations. Some trusts are automatically created between domains in the forest.  For example, the parent-child and tree-root trust relationships.

	Trust Type	Description
1	Parent-child	Trust between parent and child domains in the same domain tree.
2	Tree-root	Trust between domain trees in the same forest.

Are there other trust relationships?

Other trust relationships can be manually created as needed

You can configure additional trusts between domains within your forest, between your forest and other forests, and between your forest and other security entities, such as Kerberos realms or an older Active Directory domain.

	Trust Type	Description
3	Shortcut	Use shortcut trusts to improve user logon times between two domains in an Active Directory forest. This is useful when two domains are separated by two domain trees.
4	Forest	Use forest trusts to share resources between forests.
5	Realm	Use realm trusts to form a trust relationship between platforms other than Windows utilizing a Kerberos realm or an Active Directory domain.
6	External	Use external trusts between resources that are located on a domain in another forest that is not joined by a forest trust.

Windows Server - Directionality and Transitivity

Trusts can have different directionality and transitivity

There are transitive and nontransitive trusts

Trusts can be transitive or nontransitive. In a transitive trust, A trusts B and B trusts C, and then A also implicitly trusts C. For example, if you lend Steve your laptop, and Steve lends his car to Mary, then you might be willing to lend your mobile phone to Mary.

There are one-way or two-way trusts

A one-way trust means that, although one entity trusts the other, the reciprocal is not true. For example, just because you lend Steve your laptop does not mean that Steve will lend you his car. In a two-way trust, both entities trust one another. In a single forest, all domains trust one another with internal, two-way transitive trusts. Basically, this means that all domains trust all other domains.