Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When a workstation or server attempts to authenticate a user on another domain, does the workstation or server contact the other domain's DC directly to authenticate after contacting the local domain DC? Or does the local domain DC do the authentication request on behalf of the workstation?

I currently have two domains.
Domain hosted.contoso.com and office.contoso.com.
All users are created in the office.contoso.com domain, so a user Smith@office.contoso.com wants to login to a machine host1.hosted.contoso.com. Does host1.hosted.contoso.com need to have visibility to domain-control.office.contoso.com directly?

share|improve this question
+1, always wanted to know that... –  Massimo Oct 12 '09 at 5:40

1 Answer 1

up vote 1 down vote accepted

The user Smith is authenticated on domain office.contoso.com. This domain is in trust with hosted.contoso.com and provides the user Smith with a ticket for the host1.hosted.contoso.com.

In other words: The user is authenticated in its own domain (the other domain can't verfiy). So when the user connects to a foreign domain, the DC creates a valid ticket for the other domain (if trusted domains). So in your example, host1 doesn't need to see dc.office, but dc.office needs a connection to dc.hosted.

Also have a look at http://blogs.msdn.com/anthonw/archive/2006/08/02/686041.aspx

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.