An Active Directory trust (AD trust) is a method of connecting two distinct Active Directory domains (or forests) to allow users in one domain to authenticate against resources in the other. In simplest terms, it is the process of extending the security boundary of an AD domain (or forest) to include another AD domain (or forest).

There are multiple parameters to configuring an Active Directory trust that will not be discussed in this article; itopia recommends that administrators research AD trusts to gain a full understanding of their impact and implications before proceeding. Concepts like transitivity, implicit trusts, SID filtering, and scoping are not covered in this article but are important aspects of defining the impact of a trust relationship.

It is important to understand several terms that will be used in this article:

AD trusts relationships are directional; a trust can be configured as a one-way or two-way trust. In a one-way trust, one domain is specified as the Accounts domain and the other is the Resource domain; in Microsoft's confusing terminology, the trust is incoming to the Accounts domain and outgoing from the Resource domain. A two-way trust is effectively two one-way trusts; each domain is configured as both the Accounts domain and the Resource domain, so users in either domain can access resources in the other domain.

NOTE: It is important to understand that the phrase "can access resources" does not mean that Accounts users have any implicit access to the resources in the trusting (Resource) domain; it is more accurate to say that Accounts users "can be granted access to resources" in the Resource domain.

In order to create an AD trust between two Active Directory domain, the following requirements must be satisfied:

To support the AD trust, the servers in each domain must be able to communicate with domain controllers in the trusted domain over a number of network ports. For Cloud Desktop, this requires:

The table below provides the minimum network ports that are required for Active Directory trust functionality. Additional information is available in Microsoft's documentation.

Once network connectivity has been established, both Active Directory domains must be configured with DNS forwarding rules so that they can access each other's Active Directory DNS records.

The most common way to achieve this is to create conditional forwarders for each domain's FQDN on the other domain's DNS servers. Consider the following example:

Once network connectivity is established between these two domains (as described above), an administrator for each domain would configure the following:

To create a conditional forwarder:

NOTE: There are other methods of establishing DNS name resolution between domains, and in some cases these other methods may be necessary. For example, if one domain resides behind a Network Address Translation (NAT) interface, the IP addresses returned by its DNS servers will not match the IPs that the other domain must use to communicate. In this scenario, you would need to create a DNS zone for the other domain's FQDN, manually create DNS A records for the domain controllers (and the domain name itself) using the NAT IP addresses, and then delegate the _msdcs.<domain FQDN> subdomain to the domain controllers in the other domain.

Once the prerequisites have been established and verified, you can proceed to create an AD trust. As mentioned at the beginning of this article, there are several important security decisions that must be made prior to creating a trust, and analysis of these decisions is beyond the scope of this article. itopia recommends that you research and understand AD trusts before proceeding.

In the example below, we will configure the following:

We will initiate the trust creation from the Resource domain (contoso.local) and configure the New Trust Wizard to create the trust in both domains; if this is not possible in your environment, you can run the New Trust Wizard separately in each domain and configure it not to create the trust in the other domain.

This article provides a basic overview of the steps to create a simple Active Directory trust. The process defined above may not be suitable for every environment; it is important to understand the implications of an AD trust and to confer with your Security and Directory teams before deciding on the trust configuration that is appropriate for your environment.