Forest Trust is a transitive trust established between the forest-root domains of two Active Directory forests.
Simple definition
Forest Trust is a transitive trust established between the forest-root domains of two Active Directory forests. It belongs to the Active Directory vocabulary and is useful when reading architecture diagrams, product documentation, logs, or administration procedures.
What is it used for?
Its main purpose is to enable authentication across resources in two forests with broader scope than an external trust. The practical value depends on the surrounding architecture, security model, and operational requirements.
How does it work?
The trust can carry trust across domains in both forests, with name-suffix routing, authentication, and SID-filtering options.
Key points
- Scope: A transitive trust established between the forest-root domains of two Active Directory forests.
- Operational goal: Enable authentication across resources in two forests with broader scope than an external trust.
- Implementation: The trust can carry trust across domains in both forests, with name-suffix routing, authentication, and SID-filtering options.
Points to watch
A trust does not replace ACLs; combine direction, transitivity, SID filtering, and authentication scope with least privilege.
In short
Forest Trust = a transitive trust established between the forest-root domains of two Active Directory forests. Use it when you need to enable authentication across resources in two forests with broader scope than an external trust.