After raising my forest functional level from Windows Server 2000 to Windows Server 2003, I need to promote an existing trust between two domains in this forest from the external trust type to the forest trust type. As it seems that it is not possible to upgrade an existing trust, I will have to remove and recreate it. Could someone confirm this and tell me the risks for existing groups, policies, etc ? As an example, I have groups in one domain that have users from both domains and that I can't afford to loose...

One domain controller runs under Windows 2003 Server, the other one under 2008.


External Trusts are from one domain to another. You have to recreate the trust to make it a forest trust (one forest transitively to another); this also has to be done between the forest roots (which might not necessarily be the domains in question).

| improve this answer | |
  • That's what I feared... What does it mean for objects that depend on the external trust (group membership...), if I have to recreate it ? – user48940 Jul 22 '10 at 7:15
  • No, the group objects will still contain the user SIDs, and vice versa. So none of that needs to be changed (unless the relevant object in AD changes). There just needs to be a trust available that can resolve the SID, otherwise it will appear in AD as the actual SID (AD will no longer be able to resolve the SID to a user/group name). You should be able to do this over a weekend and nobody should notice come Monday (be sure you test, test, test that that new trust is working the way you expect). – Chris S Jul 22 '10 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy