Understanding Forest Trusts

By Author: smileyi
Total Articles: 30
Comment this article

In Windows NT and Windows 2000, if users in one forest needed access to resources in a second forest, an administrator had to create an external trust relationship between the two domains. Because external trusts are one-way and nontransitive, they require administrator resources and limit the ability for trust paths to extend to other domains. Forest trusts are a new feature in Windows Server 2003, extending transitivity beyond the scope of a single forest to a second Windows Server 2003 forest. Forest trusts provide the following benefits: 70-291

Simplified management. Forest trusts reduce the number of external trusts necessary to share resources with a second forest.
Two-way trust relationships between all domains in two forests.
UPN authentications can be used across two forests.

Both the Kerberos and NTLM authentication protocols can be used to help mprove the trustworthiness of authorization data transferred between forests.

Administrative flexibility. Administrators can choose to split collaborative delegation efforts with other administrators ...
... into forest-wide administrative units. MCSE

Forest trusts can be created and are transitive between only two forests. Therefore, if a forest trust is created between Forests and Forest2, and a forest trust is also created between Forest2 and Forest3, Forests does not have an implicit trust with Forest3.

The operating system administrator is not the same as the CA Administrator. However, while the computer administrator role might be necessary to perform some duties necessary for the CA, the assignment of the CA Administrator role does not provide a user with computer Administrator privileges. The CA Administrator role applies only to specific CA-related tasks.