Active Directory trusts let users in one domain access resources in another — essential for organizations with multiple domains from mergers, acquisitions, or deliberate network segmentation.
Trust Direction and Transitivity
- One-way trust — Domain A trusts Domain B, meaning B’s users can access A’s resources, but not vice versa
- Two-way trust — both domains trust each other equally
- Transitive trust — extends automatically through a chain (default within a single AD forest)
- Non-transitive trust — applies only to the two domains directly involved, doesn’t extend further
# View existing trusts Get-ADTrust -Filter * # Create a new forest trust (two-way, by default) netdom trust domainA.local /d:domainB.local /add /twoway /userD:admin /passwordD:*
Why Trusts Matter for Security
A misconfigured trust — particularly an overly broad two-way trust with an external, less-trusted domain — can expose your entire domain to compromise if the trusted domain is breached. Always scope trusts as narrowly as the actual business need requires (selective authentication, specific OUs) rather than defaulting to the broadest possible trust.