Creating And Administering Trusts Using The Command Line Tool

By Author: qianxun5
Total Articles: 40
Comment this article

In addition to creating and administering trusts using the Windows interface, you can also create and administer most trusts by using the Netdom.exe: Windows Domain Manager command line tool, included with the Windows Support Tools on the Windows Server 2003 Setup CD-ROM. You use the netdom trust command to create, verify, or reset a trust relationship between domains. And these issues might be account in the 70-297 Exam.

Netdom trust has the following syntax:

Specifies the name of the trusting domain.

Specifies the name of the trusted domain. If the parameter is omitted, then the domain that the current computer belongs to is used.

Specifies the user account that makes the connection with the trusting domain. If this parameter is omitted, the current user account is used.

Specifies the password of the user account that is specified in the / parameter. Use * to be prompted for the password.

Verifies the secure channel secrets upon which a specific trust is based.

Resets the trust secret between trusted domains or between the domain controller ...
... and the workstation.

Specifies a new trust password. This parameter is valid only with the /add parameter and only if one of the domains specified is a non-Windows Kerberos realm. The trust password is set on the Windows domain only, which means that credentials are not needed for the non-Windows domain.

Specifies to create a trust.

Indicates that the trust is created to a non-Windows Kerberos realm. The /realm parameter is valid only with the /add and /password parameters.

Removes both the trusted domain object and the cross-reference object for the specified domain from the forest. This is used to clean up decommissioned domains that are no longer in use and were not able to be removed by using the Active Directory Installation wizard. This can occur if the domain controller for that domain was disabled or damaged and there were no domain controllers or it was not possible to recover the domain controller from backup media. This parameter is valid only when the /remove parameter is specified.

Specifies to establish a two-way trust relationship rather than a one-way trust relationship.

Specifies to exercise the Kerberos protocol between a workstation and a target domain. This parameter is valid only when the /verify parameter is specified.

Specifies whether to set a transitive or nontransitive trust. This parameter is valid only for a non-Windows Kerberos realm. Non-Windows Kerberos trusts are created as nontransitive. If a value is omitted, then the current transitivity state is displayed. Yes sets the realm to a transitive trust. No sets the realm to a nontransitive trust.

Specifies verbose output. By default, only the result of the operation is reported. If /verbose is specified, the output lists the success or failure of each transaction necessary to perform the operation as well as returning an error level based on the success (0) or failure (1) of the operation.

Note Netdom cannot be used to create a forest trust. You can type the command netdom query trust to see a list of existing trust relationships.For further information about using Netdom to create and administer trusts, refer to Windows Support Tools help.
If you are interested in this area, you can vist our site on the 70-297 series, we are also offer free Microsoft exam papers.