Tree-root trust confusion

Question

Ok, this is probably an easy one, but I could swear I have read it in one or the other Active Directory related book, and now I just can't get it out of my head even though no other sources seem to confirm it, and it sounds unnecessary and wrong. It could easily be from some documentation dating back to very early betas of AD, for all I know.

The statement was that when you create a child domain (say "accounting.france.company.lcl") of a domain (say "france.company.lcl")that is itself already a child domain of the tree-root domain(say "company.lcl"), Active Directory will not only create a two-way transitive trust between these two parent and child domains, but also an automatic two-way transitive trust directly between the downlevel child, and the tree-root 2 steps up. So the trust between the downlevel child domain and the tree-root domain would not only be implicit - transitive through the intermediate direct parent domain - but also more like a shortcut trust.

It would just be nice if someone could wipe this out of my head by a strong statement. :-)

Answer 1

According to This technet article, the default intra-tree trust architecture is rooted and transitive, not full-mesh.

My trusty copy of Windows 2000 Active Directory by Lowe-Norris does contain some confusing language that could be misconstrued as implying that a full-mesh trust system is set up, Maybe that's where your confusion is coming from?

Answer 2

An AD trust is represented in AD by a TDO (trustedDomain object). If you view the domain partition in ADSIEdit you'll see that a TDO exists for a child domain's direct parent domain and it's child domains (if they exist). You won't see a TDO for any shortcut trusts because they're not automatically created between child domains. The trust path is "vertical".