The Environment: One AD domain that is not managed by local admins (can’t edit, can’t add GPO, etc.) Users have accounts here. Call this AD alpha This AD Alpha has a trust to a local AD domain (Call this one Zeta) that local admins administer. Contains computer accounts. Has accessible network shares
Goal: Set permissions on AD Zeta’s network shared folders using AD Alpha’s user accounts and AD Zeta computer accounts for folder access.
Reason: To make sure that when a users using credentials from Alpha accesses a share on Zeta, they can only do so if they are also accessing that share from a machine they would normally use during working hours.
Example: User A logged in with computer A = grant access User A logged in with computer B= no access
User B logged in with computer B = grant access User B logged in with computer A= no access