Trusts בין דומיינים ויערות

A Trust is an agreement between domains that lets users from one domain access resources in another domain, without creating an additional account for them.

Direction: one-way or two-way.
Transitive — the trust passes on to additional domains; Non-transitive — it does not.
Trust — trust between two different forests.
SID Filtering — filters foreign SID History and prevents privilege escalation between forests.

Get-ADTrust -Filter *
netdom trust lab.local /domain:partner.local /quarantine:yes

powershell

Architecture and Theory — Under the Hood

Trust allows users from one domain to access resources in another domain. Types: One-Way/Two-Way, Transitive/Non-Transitive, /External/Realm.

Within a — Trust is automatic, transparent, transitive.
Between Forests — Trust (transitive only between top-level domains).
SID Filtering and Selective Authentication are the main protections.

Practical Configuration (PowerShell / GUI)

# Create Forest Trust
netdom trust corp.com /Domain:partner.com /add /twoway /Forest

# Enable SID Filtering (prevents SID History injection)
netdom trust corp.com /Domain:partner.com /quarantine:yes

# Check
Get-ADTrust -Filter *

powershell

Real-world Scenarios in Organizations

Company Mergers — Temporary Trust until objects are migrated.
External Vendors — Selective Authentication + External Trust only.

Diagnosis and Troubleshooting

netdom trust /verify — Trust health check.
Event 4706/4707 — Trust creation/deletion.

Glossary and Quick Command Line

SID History — A feature that allows access based on an old SID.
Referral — DC refers the client to the ticket for the foreign domain.

Trusts Between Domains and Forests

What you will learn here

Check yourself