Active Directory Trust Policies
AD trusts let users in one domain authenticate to resources in another. (For the containment hierarchy the trusts live in — domains, trees, and why the forest is the real boundary — see active-directory-domains-trees-forests.) The direction vocabulary trips everyone up: if domain A trusts domain B, then A is the trusting domain, B is the trusted domain — and it is users in B who gain access to resources in A. Access flows opposite to the arrow of trust. Trusts are stored in the directory as trusted domain objects (TDOs), each carrying a shared trust key used to encrypt inter-realm Kerberos referrals.
Trust types
| Type | Transitivity | Direction | Notes |
|---|---|---|---|
| Parent/Child | Transitive | Two-way | Auto-created when a child domain joins a forest |
| Tree/Root | Transitive | Two-way | Auto-created between a new tree root and the forest root |
| Shortcut (CrossLink) | Transitive | One/two-way | Manual optimization that shortens long intra-forest trust paths |
| External | Non-transitive | One/two-way | To a domain outside the forest; only applies when no forest trust exists |
| Forest | Transitive (within pair) | One/two-way | Between two forest roots; not extensible to a third forest |
| Realm | Either | One/two-way | AD domain ↔ non-Windows RFC4120 Kerberos realm |
Every domain inside a forest is linked by some two-way transitive path — which is why the forest, not the domain, is the real security boundary, and why shortcut trusts are largely redundant conveniences. Forest trusts don’t chain: a Forest1↔Forest2 trust plus a Forest2↔Forest3 trust gives Forest1 no implicit access to Forest3.
Transitivity in one breath
- Transitive = the trust extends beyond the two domains that formed it.
- Non-transitive = it stops at the pair. External and (optionally) realm trusts are the non-transitive members of the family.
SID filtering
Across inter-forest boundaries, SID filtering (quarantine) strips SIDs from another forest’s PAC — blocking the SID-history injection that makes intra-forest pivoting so reliable. Within a forest there is no SID filtering between domains, which is the architectural gap behind trust pivoting (“Trustpocalypse”): compromise any child, forge ExtraSids for Enterprise Admins, own the forest.
Enumeration
nltest /domain_trusts /all_trusts # built-in
Get-NetDomainTrust; Get-NetForestTrust # [[powerview|PowerView]]
Get-ADTrust -Filter * # RSATSources
- How trust relationships work for forests in Active Directory
- Understanding Trust Transitivity
- TrustType Enum
- MS-ADTS 6.1.6.7.15 trustType
Related: active-directory-trust-pivoting, kerberos, golden-and-silver-ticket-attacks, active-directory-enumeration, active-directory-groups, powerview, microsoft-365-federation.