Trust Relationships

By Author: crystal clinton
Total Articles: 129
Comment this article

A trust relationship is a link between two domains in which the trusting domain honors the logon TS windows vista authentication of the trusted domain, as shown in Figure 1-13- Users and applications are authenticated in the Windows Server 2003 family using one of two taist protocols: Kerberos version 5 or NT LAN Manager (NTLM). The Kerberos version 5 protocol is the default protocol for computers running Windows Server 2003. If any computer involved in a transaction does not support Kerberos version 5, the NTLM protocol is used. A trust relationship is also permitted with any MT Kerberos version 5 realm. There are two domains in a trust relationship—the trusting and the trusted domain.
Trusts have the following characteristics:
Trusts can be created manually (explicitly) or automatically (implicitly). Not all trusts can be created both ways.
Trusts can be not bound by the domains in the trust relationship (transitive), or they can be bound by the domains in the trust relationship (non-
transitive). For example, a transitive trust means that if a Domain ...
... A trusts Domain B and Domain B trusts Domain C, then Domain A trusts Domain C. Sim-
ilarly, a nontransitive trust means that if Domain A trusts Domain B and Domain B trusts Domain C, there is no trust relationship between Domain A and Domain C.Direction Trusts can be one-way or two-way. A one-way taist is a single 70-620 practice test trust relationship, where Domain A trusts Domain B, as shown in Figure 1-13. One way relationships can be nontransitive or transitive depending on the type of trust being created. In a two-way trust, Domain A trusts Domain B and Domain B trusts Domain A. This means that authentication requests can be passed between the two domains in both directions.
In the Windows Server 2003 family, Active Directory supports the following forms of trust relationships:
A tree-root trust is implicitly established when you add a new tree root domain to a forest. For example, in Figure 1-14, a tree-root trust is established between Domain A and Domain 1 when Domain 1, a new tree root domain, is added to the forest. The trust is created between the domain you are creating (the new tree root) and the existing forest root domain. A tree-root trust can be set up only between the roots of two trees in the same forest. The trust is transitive and two-way.
A parent-child trust relationship is implicitly established when you create a new child domain in a tree. For example, in Figure 1-14, a parent-child trust is established between Domain 1 and Domain 2 when Domain 2, a new child domain, is added to the tree. The Active Directory installation process
automatically creates a trust relationship between the new domain and the domain that immediately precedes it in the namespace hierarchy (for example,
uk.microsqft.com is created as the child of microsoft.com). As a result, a domain joining a tree immediately has trust relationships established with every domain in the tree. These trust relationships make all objects in the domains of the tree MCSE study guides free download available to all other domains in the tree. The trust is transitive and two-way.