Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In our organization, we have two Active Directory forests, A and B, without any trust relationship between them. Now, we need to have a Sharepoint 2010 installation which allows users from both domains to login.

IT is mentioning a trusted relationship between two forests is a breach of security as it can't provide data/service isolation. Is this correct? Is it possible to configure this without a trusted relationship between two forests?

share|improve this question

Creating a trust relationship gives you the possibility of authorizing and/or denying access to users and groups from the new domain. A trust relationship does not guarantee access to anything for anyone in the new domain.

Keep in mind that the built-in "Authenticated Users" and "Everyone" groups do include users from other trusted domains, whereas "Domain Users" does not. If your network permissions were set up correctly in the first place, this will not present any problems.

If you or your IT colleagues have any doubts at all, set up a test account on the trusted domain and use it to verify that access is denied wherever you expect it to be denied.

share|improve this answer
Miles: Correct me if I'm wrong. Wouldn't a forest trust that uses Forest-wide authentication grant users in the trusted domain access to anything in the trusting domain that the Authenticated and Everyone groups have access to, as opposed to Selective authentication? – joeqwerty Jan 4 '12 at 17:42
@joeqwerty That is correct, so far as I know. – Skyhawk Jan 5 '12 at 6:10
Thanks much, Miles. – joeqwerty Jan 5 '12 at 11:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.