Good day, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at implementing active directory trusts.
Let's take a look at what we're going to cover.
First up we'll take a moment to understand
what a trust relationship is.
Then we'll take a look at the types
of trust you can configure.
And then finally, we'll do a demo
where we will configure a forest trust.
Let's jump in.
So what are trust relationships?
Well, a trust enables users to access resources
across domains and forests in environments
where there are multiple domains and multiple forests.
And trust can be between domains in a forest
and these are created automatically when
creating new domains within a forest, or between forests,
and these are created manually.
And trusts, just like everything in Active Directory,
depend heavily on DNS.
You need to ensure that you have properly
configured DNS using forwarders,
conditional forwarders, or stub zones.
And check back to section 1
if you need to brush up on any of those concepts.
Now trust can be configured either one-way or two-way
and the direction of the trust is opposite
to the direction of the access.
So if you want users in the corp.barrierreefaudio.com
forest to access resources in the dev.rivercityai.com
forest, then you need to configure a trust
in the opposite direction of that access.
The trust direction needs to be
from dev.rivercityai.com back to corp.barrierreefaudio.com,
and trusts can also so be transitive.
Now, what do I mean by that?
Transitivity allows domains to indirectly trust each other.
It's important to note that transitivity
does not apply to forests.
If you have 3 forests with indirect trust configured,
you cannot use an intermediate forest trust to access
a forest that is not directly trusted,
and trust between domains in a forest are automatically
created two-way transitive trusts.
Now let's take a look at the types
of trusts that you can configure.
In this example, Barrier Reef Audio
has acquired River City AI and they want
to share resources between the 2 active directory forests.
The first type of trust you can configure
to provide this type of access is a forest trust,
and forest trusts are used to provide access
between 2 forests and forest trusts are always transitive.
So the users in both the parent root domain
of Barrier Reef Audio and the trial domain
will be able to access the resources
in the dev.rivercityai forest.
And if required, the trust can be
configured to be either one-way or two-way.
But what if you only want to allow a subset
of users to access resources in the other forest?
Well, forest trusts support either selective
or two-way authentication.
With forest-wide authentication,
all users are able to authenticate with the other forest.
With selective authentication,
only allowed users are allowed to authenticate.
But here is an important tip for the exam.
Users still need to be granted access
to the resources they intend to access,
like file shares or databases,
even when using selective authentication.
Another option would be to configure an external trust.
Let's say that only users in the child domain
us.corp.barrierreefaudio.com need to access
resources in the dev.rivercityai.com domain.
An external trust can be used to provide access
between 2 domains in separate forests
where no forest trust exists.
External trusts are always non-transitive
and they can be either one-way or two-way
and used to provide access in either
direction or both directions.
And you can narrow the list of users
that can authenticate using the external trust
by using either selective or domain-wide authentication.
Now, let's take a look at realm trusts.
Realm trusts are used to provide access
between a Windows-based domain
and a non-Windows based Kerberos realm.
They can be either transitive or non-transitive,
and they can be either one-way or two-way,
but unlike the other trusts,
they don't support selective authentication.
And the last trust type to be aware
of is the shortcut trust.
And it's used to reduce authentication time
between 2 non-adjacent domains in the same forest.
Shortcut trusts can be considered transitive
as transitive trusts already exist
between all of the domains and the forest.
And they can be either one-way or two-way,
but because shortcut trusts are created
within a single forest,
selective authentication cannot be used.
All right, let's take a look at a demo
of configuring a forest trust.
In this demo we're going to assume
that Barrier Reef Audio has acquired
another company called River City AI,
and Barrier Reef Audio has its own AD DS forest
and domain controllers, as does River City AI.
And they would like to work together.
In this demo we'll create a two-way forest trust
and we'll complete these tasks using
our administrative server, ADM01.
We'll start the demo by confirming
that DNS is configured as required to support
the creation of Active Directory forest trusts
and then we will create a two-way forest trust
using forest-wide authentication.
Let's jump into the demo.
All right, so here we are logged
onto our internal administrative server, ADM01,
in the corp.barrierreefaudio.com domain.
First, we're going to confirm that DNS
is configured correctly to support
the creation of Active Directory trusts.
We'll launch administrative tools
and then we're going to select DNS.
And we've connected to our CORP-BNE-DC01 domain controller
in the corp.barrierreefaudio.com domain,
and let's confirm that we have
either a stub zone or a conditional forwarder
configured for dev.rivercityai.com,
which is the target for our Active Directory forest trust.
We'll expand the DNS server node
and then we'll select forward lookup zones.
We only have our internal
corp.barrierreefaudio.com zone here,
so we don't have a stub zone configured.
Let's check if we have a conditional forwarder configured,
and we can see here we have a conditional
forwarder configured for dev.rivercityai.com.
Let's confirm that this client is able
to resolve dev.rivercityai.com.
We'll use PowerShell to do that.
So we'll just launch PowerShell
and we'll use the Resolve DNS name PowerShell commandlet
and we'll confirm that we can resolve dev.rivercityai.com,
and we can. Let's go ahead and close this window,
and then we'll close DNS Manager.
Now let's use the Active Directory Domains
and Trusts Administrative Tool to configure
an Active Directory forest trust.
We'll go ahead and launch Active
Directory Domains and Trusts
and then we'll right-click on
our domain and select Properties.
We'll navigate to the Trust tab
and we can see here that there's no trust configured.
So we'll go ahead and select New Trust.
We'll select Next on the welcome screen and
because we're are connected to corp.barrierreefaudio.com,
we're going to provide the DNS name
for dev.rivercityai.com.
And we're logged on as a user
that is a member of the Enterprise Admins privilege
group in the corp.barrierreefaudio.com forest.
We'll go ahead and select Next,
and we're going to go ahead and create a forest
trust and we'll select Next and now
we can specify the trust direction.
We're going to create a two-way trust
between these 2 forests so users
can authenticate in both directions.
We'll go ahead and select Next
and if we have access to a user account that is a member
of the Enterprise Admins group in the target forest,
we can create the trust in both directions.
So we're going to go ahead and create
the trust in both directions here.
And it's important to know that DNS
would need to be appropriately configured
in the target forest to be able to create the trust
in both directions and then we'll select Next.
Now we need to provide credentials for a user account
that is a member of of Enterprise Admins
in dev.rivercityai.com,
so we'll go ahead and enter in our username and password.
Now, if you were an Enterprise Administrator
in corp.barrierreefaudio.com
and you had no access to dev.rivercityai.com,
you could create the trust in both domains
separately using different administrators.
Another important point to make here
is that if we were only creating one side of this trust
we would need to specify a trust password,
and that trust password would need to be used when
creating the other side of the trust,
but for our purposes, because we have access
to a user account that is a member of Enterprise Admins
in both forests, we'll go ahead
and create it in both directions.
We'll go ahead and select Next
and now we have the opportunity to select forest-
wide authentication or selective
authentication for the outgoing trust.
This is from corp.barrierreefaudio.com
to dev.rivercityai.com.
We're going to select Forest-Wide Authentication
and now we have the opportunity to configure
the authentication for the trust in the opposite direction
from dev.rivercityai.com back to corp.barrierreefaudio.com.
We're going to go ahead and select Next,
and we can see here that we are creating a trust
between corp.barrierreefaudio.com and dev.rivercityai.com.
We're creating a two-way trust and it's a forest trust
and it's transitive and we're creating
the trust in both directions.
We'll go ahead and select Next
and now that the trust creation is complete,
we'll go ahead and select Next,
and then we'll go ahead and confirm the outgoing trust.
We'll select Yes to confirm
and then we'll go ahead and select Next,
and then we'll confirm the incoming trust as well.
So we'll say Yes to confirm the incoming trust
and then we'll select Next,
and now we've successfully configured
and confirmed the trust relationship
between dev.rivercityai.com and corp.barrierreefaudio.com.
We'll go ahead and select Finish
and we can see that our trusts are configured.
We have our outgoing trust configured
and our incoming trust configured.
All right, that concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right. So what have we covered?
Trust relationships enable access to resources
across domains and forests.
And it's important to know that trust
can be created in either one direction or both directions
and the trust direction must be the opposite direction
to the direction of access and trust
can be either transitive or non-transitive
and transitivity allows access
where a direct trust does not exist.
It's also important to remember
that authentication can be either selective or forest-wide.
Use selective authentication to provide granular control
over who can access resources using the trust,
and there are 4 trust types to remember.
They are the forest trust, which is used to provide access
between two active directory forests;
external trusts, which is used to provide access
between 2 domains in separate forests
and the realm trust type which is used to provide access
between a Windows-based domain
and a non-Windows Kerberos realm.
And finally there's the shortcut trust,
which is used to reduce authentication time
within a forest between two domains
that frequently share resources.
All right, that concludes this lesson.
Thanks for being with me and I hope you found it useful,
and I look forward to seeing you in the next lesson.