Selective Authentication

By Author: Mike Jones
Total Articles: 256
Comment this article

In Chapter 4, "Installing and Managing Domains, Trees, and Forests," you learned that in get a+ certified online Windows Server 2003, you can determine the scope of authentication between two domains that are joined by an external trust or a forest trust. Recall that an external trust must be explicitly created by a systems administrator between Windows Server 2003 domains that are in different forests or between a Windows Server 2003 domain and a domain whose domain controller is running Windows NT 4 or earlier. The trust is non-transitive. A forest trust is explicitly created by a systems administrator between two forest root domains. The trust is transitive between two forests only. Both trusts can be one- or two-way.
You can set selective authentication differently for outgoing and incoming external and forest trusts. These selective trusts allow you to make flexible access control decisions between external domains and forest-wide.
If you use domain-wide authentication on the incoming external or forest trust, users in the second domain or outside forest would have ...
... the same level of access to resources in the local domain or forest as comptia users who belong to the local domain or forest. For example, if DomainA has an incoming external trust from DomainB and domain-wide authentication is used, any user from DomainB would be able to access any resource in DomainA (assuming that they have the required permissions). Similarly, if ForestA has an incoming forest trust from ForestB and forest-wide authentica?tion is used, any user from ForestB would be able to access any resource in ForestA (assuming they have the required permissions).
If you set selective authentication on an incoming external or forest trust, you need to manually assign permissions on each resource to 'which you want users in the second domain or forest to have access. To do this, set the Allowed To Authenticate permission on an object for that particular user or group from the external domain or forest.
The settings for the Apply Onto list and the Apply These Permissions To Objects And/ Or Containers Within This Container Only check box in the Permission Entry dialog box for an object are the same in both the free practice exam questions Object and Properties tabs, regardless of the tab in which they are set. Therefore, you don't need to make changes to both tabs.