4

Using an existing AD domain (company.net), we need to add a child domain (untrusted.company.net) with a one-way trust. Testing in my lab, and the google searching that I have done seem to suggest that this is impossible to achieve as there is a default unchangeable two-way trust established when a child domain is created.

Does anyone know of a way to achieve this goal?

I know I could create a separate forest, but that has been nixed by my boss. The management at my company (boo... hiss..) requires this to be an actual child domain.

Details: Existing domain and forest are 2008 functional level on 2008 r2 SP1 boxes. Child domain will be on 2008 R2 SP1, and will start at a 2008 functional level.

1
  • 2
    A two way transitive trust between a parent and child domain is unremoveable.
    – joeqwerty
    Oct 14, 2011 at 19:27

2 Answers 2

7

A cross forest trust relationship is by definition impossible when the domains aren't in different forests.

You'll need to have a nice chat with the manager making that call and explain that those two requirements conflict, unfortunately.

4
  • I am not asking about cross-forest trust relationships. What I am trying to see is if it is possible to to have a child domain that trusts the parent while not being trusted by the parent. Oct 14, 2011 at 16:45
  • @FinalizedFrustration Security principles from a child are always, always valid in a parent. But, what's your goal here? It's not like it assigns principles from a child domain to the Enterprise Admins group by default or anything, but if you're trying to making the parent domain invisible, it's impossible. Oct 14, 2011 at 16:49
  • 1
    Basically, the management want a domain to place "untrusted" constituent accounts in for SSO authentication purposes, while preventing them from authenticating to domain computers on site. I have tried to explain we can prevent this with group policy and AD permissions, but they don't want to take a chance. And for some reason, they are dead set against multiple forests. Thankfully, your answer here gives me some better ammo to make my case =) Oct 14, 2011 at 16:56
  • 1
    Yup - by default those users won't have privileges to hit much of anything on the parent domain aside from necessary resources; careful control of privilege assignments should do the trick! Oct 14, 2011 at 17:20
5

Child domain have a built-in two way transitive trust. You cannot modify this behavior. If you need a security boundary, then you need separate forests.

Separate domains create management boundaries. Separate forests create security boundaries.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .