Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using an existing AD domain (company.net), we need to add a child domain (untrusted.company.net) with a one-way trust. Testing in my lab, and the google searching that I have done seem to suggest that this is impossible to achieve as there is a default unchangeable two-way trust established when a child domain is created.

Does anyone know of a way to achieve this goal?

I know I could create a separate forest, but that has been nixed by my boss. The management at my company (boo... hiss..) requires this to be an actual child domain.

Details: Existing domain and forest are 2008 functional level on 2008 r2 SP1 boxes. Child domain will be on 2008 R2 SP1, and will start at a 2008 functional level.

share|improve this question
1  
A two way transitive trust between a parent and child domain is unremoveable. –  joeqwerty Oct 14 '11 at 19:27

2 Answers 2

up vote 6 down vote accepted

A cross forest trust relationship is by definition impossible when the domains aren't in different forests.

You'll need to have a nice chat with the manager making that call and explain that those two requirements conflict, unfortunately.

share|improve this answer
    
I am not asking about cross-forest trust relationships. What I am trying to see is if it is possible to to have a child domain that trusts the parent while not being trusted by the parent. –  Joseph Alcorn Oct 14 '11 at 16:45
    
@FinalizedFrustration Security principles from a child are always, always valid in a parent. But, what's your goal here? It's not like it assigns principles from a child domain to the Enterprise Admins group by default or anything, but if you're trying to making the parent domain invisible, it's impossible. –  Shane Madden Oct 14 '11 at 16:49
1  
Basically, the management want a domain to place "untrusted" constituent accounts in for SSO authentication purposes, while preventing them from authenticating to domain computers on site. I have tried to explain we can prevent this with group policy and AD permissions, but they don't want to take a chance. And for some reason, they are dead set against multiple forests. Thankfully, your answer here gives me some better ammo to make my case =) –  Joseph Alcorn Oct 14 '11 at 16:56
    
Yup - by default those users won't have privileges to hit much of anything on the parent domain aside from necessary resources; careful control of privilege assignments should do the trick! –  Shane Madden Oct 14 '11 at 17:20

Child domain have a built-in two way transitive trust. You cannot modify this behavior. If you need a security boundary, then you need separate forests.

Separate domains create management boundaries. Separate forests create security boundaries.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.