Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After raising my forest functional level from Windows Server 2000 to Windows Server 2003, I need to promote an existing trust between two domains in this forest from the external trust type to the forest trust type. As it seems that it is not possible to upgrade an existing trust, I will have to remove and recreate it. Could someone confirm this and tell me the risks for existing groups, policies, etc ? As an example, I have groups in one domain that have users from both domains and that I can't afford to loose...

One domain controller runs under Windows 2003 Server, the other one under 2008.

share|improve this question

External Trusts are from one domain to another. You have to recreate the trust to make it a forest trust (one forest transitively to another); this also has to be done between the forest roots (which might not necessarily be the domains in question).

share|improve this answer
That's what I feared... What does it mean for objects that depend on the external trust (group membership...), if I have to recreate it ? – user48940 Jul 22 '10 at 7:15
No, the group objects will still contain the user SIDs, and vice versa. So none of that needs to be changed (unless the relevant object in AD changes). There just needs to be a trust available that can resolve the SID, otherwise it will appear in AD as the actual SID (AD will no longer be able to resolve the SID to a user/group name). You should be able to do this over a weekend and nobody should notice come Monday (be sure you test, test, test that that new trust is working the way you expect). – Chris S Jul 22 '10 at 12:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.