Sunday, December 09, 2012 8:41 AM
I hope someone can help me with my question. We have a single forest, with a collection of domains like so:
What I would like is to have a one-way trust relationship where the child domains trust the parent domain only. Users in the parent domain can see all users and resources of the child domains, but the child domains can only see the actual child domain, and nothing else.
Many thanks for any help, this has been breaking my head for a while.
Sunday, December 09, 2012 9:08 AM
Transitive two-way trust is needed for replication purpose (schema, configuration).
Check Parent-child trust in How Domain and Forest Trusts Work : http://technet.microsoft.com/fr-fr/library/cc773178%28v=ws.10%29.aspx
Moreover, Domain isn't the security boundary, you should consider creating a new forest for security purpose.
Sunday, December 09, 2012 3:20 PM
Please note that every child domain has a two ways trust relationship with its parent which is transitive. This is created by default and cannot be changed. Due to transitivity, child domains trusts each other.
If you want to apply customizations when creating trust relationships, you will need to have domains in separate forests. In this case, they will no longer be considered as child domains but they will be domains in separate forests.
If you need more information, please provide us with what you want to achieve so that we can help you more.
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Sunday, December 09, 2012 3:33 PM
What are you trying to accomplish?
“but the child domains can only see the actual child domain”
Where and how are they seeing these users?
Santhosh Sivarajan | Houston, TX
Windows 2012 Book - Migrating from 2008 to Windows Server 2012
This posting is provided AS IS with no warranties,and confers no rights.
Tuesday, December 11, 2012 6:49 AMModerator
As this thread has been quiet for a while, we will mark it as ‘Answered’ as the information provided should be helpful. If you need further help, please feel free to reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish.
BTW, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks for your understanding and efforts.