up vote 2 down vote favorite
share [g+] share [fb]

Using an existing AD domain (company.net), we need to add a child domain (untrusted.company.net) with a one-way trust. Testing in my lab, and the google searching that I have done seem to suggest that this is impossible to achieve as there is a default unchangeable two-way trust established when a child domain is created.

Does anyone know of a way to achieve this goal?

I know I could create a separate forest, but that has been nixed by my boss. The management at my company (boo... hiss..) requires this to be an actual child domain.

Details: Existing domain and forest are 2008 functional level on 2008 r2 SP1 boxes. Child domain will be on 2008 R2 SP1, and will start at a 2008 functional level.

link|improve this question
100% accept rate
1  
A two way transitive trust between a parent and child domain is unremoveable. – joeqwerty Oct 14 '11 at 19:27
feedback

2 Answers

up vote 5 down vote accepted

A cross forest trust relationship is by definition impossible when the domains aren't in different forests.

You'll need to have a nice chat with the manager making that call and explain that those two requirements conflict, unfortunately.

link|improve this answer
I am not asking about cross-forest trust relationships. What I am trying to see is if it is possible to to have a child domain that trusts the parent while not being trusted by the parent. – FinalizedFrustration Oct 14 '11 at 16:45
@FinalizedFrustration Security principles from a child are always, always valid in a parent. But, what's your goal here? It's not like it assigns principles from a child domain to the Enterprise Admins group by default or anything, but if you're trying to making the parent domain invisible, it's impossible. – Shane Madden Oct 14 '11 at 16:49
1  
Basically, the management want a domain to place "untrusted" constituent accounts in for SSO authentication purposes, while preventing them from authenticating to domain computers on site. I have tried to explain we can prevent this with group policy and AD permissions, but they don't want to take a chance. And for some reason, they are dead set against multiple forests. Thankfully, your answer here gives me some better ammo to make my case =) – FinalizedFrustration Oct 14 '11 at 16:56
Yup - by default those users won't have privileges to hit much of anything on the parent domain aside from necessary resources; careful control of privilege assignments should do the trick! – Shane Madden Oct 14 '11 at 17:20
feedback
up vote 4 down vote

Child domain have a built-in two way transitive trust. You cannot modify this behavior. If you need a security boundary, then you need separate forests.

Separate domains create management boundaries. Separate forests create security boundaries.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.