Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When a workstation or server attempts to authenticate a user on another domain, does the workstation or server contact the other domain's DC directly to authenticate after contacting the local domain DC? Or does the local domain DC do the authentication request on behalf of the workstation?

I currently have two domains.
Domain and
All users are created in the domain, so a user wants to login to a machine Does need to have visibility to directly?

share|improve this question
+1, always wanted to know that... – Massimo Oct 12 '09 at 5:40
up vote 1 down vote accepted

The user Smith is authenticated on domain This domain is in trust with and provides the user Smith with a ticket for the

In other words: The user is authenticated in its own domain (the other domain can't verfiy). So when the user connects to a foreign domain, the DC creates a valid ticket for the other domain (if trusted domains). So in your example, host1 doesn't need to see, but needs a connection to dc.hosted.

Also have a look at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.