Two-Way Trust is an Active Directory trust relationship that combines reciprocal trust in both directions.
Simple definition
Two-Way Trust is an Active Directory trust relationship that combines reciprocal trust in both directions. It belongs to the Active Directory vocabulary and is useful when reading architecture diagrams, product documentation, logs, or administration procedures.
What is it used for?
Its main purpose is to allow identities on each side to be authenticated for access to the other side’s resources according to permissions. The practical value depends on the surrounding architecture, security model, and operational requirements.
How does it work?
The trust enables reciprocal authentication but does not grant access by itself: ACLs and groups remain decisive.
Key points
- Scope: An Active Directory trust relationship that combines reciprocal trust in both directions.
- Operational goal: Allow identities on each side to be authenticated for access to the other side’s resources according to permissions.
- Implementation: The trust enables reciprocal authentication but does not grant access by itself: ACLs and groups remain decisive.
Points to watch
A trust does not replace ACLs; combine direction, transitivity, SID filtering, and authentication scope with least privilege.
In short
Two-Way Trust = an Active Directory trust relationship that combines reciprocal trust in both directions. Use it when you need to allow identities on each side to be authenticated for access to the other side’s resources according to permissions.