Creating A Forest Trust

By Author: Willsimith
Total Articles: 48
Comment this article

A forest trust is a trust between two forest root domains, created to allow all authentication requests made from one forest to reach another. The procedure for creating a forest trust is similar to the one used for creating an external trust. However, before you can create a forest trust, you must complete the following preliminary tasks. MCSE

Configure a DNS root server that is authoritative over both forest DNS servers that you want to form a trust with, or configure a DNS forwarder on both of the DNS servers that are authoritative for the trusting forests. Ensure that the forest functional level for both forests is Windows Server 2003. To configure a DNS forwarder, complete the following steps:
1. Click Start, point to Administrative Tools, and then click DNS.
2. In the console tree, right click the DNS server you want to configure, and then
click Properties.
3. In the Properties dialog box for the DNS server, click the Forwarders tab.
4. In the Forwarders tab, specify the DNS domain names that require queries to
be forwarded (conditional ...
... forwarding) in the Domain box by clicking New
and typing the domain name. Type the IP address(es) of the server(s) to which the queries are forwarded in the Selected Domain's IP Address List, and then click Add.
5. Click OK in the Forwarders tab.
Note You can raise the functional level of a forest to Windows Server 2003 only if all domain controllers in the forest are running Windows Server 2003 and all domain functional levels in the forest have been raised to Windows Server 2003. To change the forest functional level to Windows Server 2003, refer to Chapter 3, "Administering Active Directory." MCSE Certification
To create a forest trust, complete the following steps:
1. Click Start, point to Administrative Tools, and then click Active Directory Domains
And Trusts.
2. In the console tree, right-click the domain node for the domain in the first forest
for which you want to create a forest trust, and then click Properties.
3. In the Properties dialog box, click the Trusts tab.
4. In the Trusts tab, shown previously in Figure 4-17, click New Trust.
5. On the Welcome To The New Trust Wizard page, click Next.
6. On the Trust Name page, shown previously in Figure 4-18, type the DNS name of
the target domain in the second forest with which you want to establish a trtist in
the Name box, and then click Next.
7. On the Trust Type page, shown previously in Figure 4-29, select the Forest Taist
option, and then click Next.
Note If the Forest Trust option does not appear, you must confirm that you have completed the preliminary tasks for creating a forest trust.
8. On the Direction Of Trust page, shown previously in Figure 4-19, select one of the
following choices:
a If you want all users in both forests to be able to access all resources anywhere in either forest, click Two-Way, and then click Next.
If you want only users in this forest to be able to access resources anywhere in the second forest, click One-Way: Incoming, and then click Next.