External Trust is a non-transitive trust between two Active Directory domains in different forests or with an external domain.
Simple definition
External Trust is a non-transitive trust between two Active Directory domains in different forests or with an external domain. It belongs to the Active Directory vocabulary and is useful when reading architecture diagrams, product documentation, logs, or administration procedures.
What is it used for?
Its main purpose is to provide targeted access between two domains without establishing forest-wide trust. The practical value depends on the surrounding architecture, security model, and operational requirements.
How does it work?
The relationship applies to the two explicitly configured domains and can be one-way or two-way.
Key points
- Scope: A non-transitive trust between two Active Directory domains in different forests or with an external domain.
- Operational goal: Provide targeted access between two domains without establishing forest-wide trust.
- Implementation: The relationship applies to the two explicitly configured domains and can be one-way or two-way.
Points to watch
A trust does not replace ACLs; combine direction, transitivity, SID filtering, and authentication scope with least privilege.
In short
External Trust = a non-transitive trust between two Active Directory domains in different forests or with an external domain. Use it when you need to provide targeted access between two domains without establishing forest-wide trust.