One-Way Trust is an Active Directory trust relationship in which trust works in only one direction.
Simple definition
One-Way Trust is an Active Directory trust relationship in which trust works in only one direction. It belongs to the Active Directory vocabulary and is useful when reading architecture diagrams, product documentation, logs, or administration procedures.
What is it used for?
Its main purpose is to allow users on one side to be authenticated for access to resources on the other side without automatic reciprocity. The practical value depends on the surrounding architecture, security model, and operational requirements.
How does it work?
One domain is the trusting side and the other the trusted side. Trust direction must be read from the perspective of the desired access.
Key points
- Scope: An Active Directory trust relationship in which trust works in only one direction.
- Operational goal: Allow users on one side to be authenticated for access to resources on the other side without automatic reciprocity.
- Implementation: One domain is the trusting side and the other the trusted side. Trust direction must be read from the perspective of the desired access.
Points to watch
A trust does not replace ACLs; combine direction, transitivity, SID filtering, and authentication scope with least privilege.
In short
One-Way Trust = an Active Directory trust relationship in which trust works in only one direction. Use it when you need to allow users on one side to be authenticated for access to resources on the other side without automatic reciprocity.