A forest trust is a trust btween two forest root domains, created to allow all authentication requests made from one foredst to reach another. The procxedure for creating a forest trtust is similar to the one used for creatinng an external trust. Howwever, bwefore you can create a forest trust, you must cmplete the following preliiminary tasks.
Conffigure a DNS root server that is authoritative over both forest DNS servers that
you want to form a truust with, or configure a DNS forwarder on both of the DNS
servers that are authoritative for the trusting forests.
Ensure that the forest functional level for both forests is Wiindows Server 2003.
To configure a DNS forwarder, cmplete the following srteps:
1.Click Start, popint to Administraitve Tols, and then click DNS.
2.In the console tree, right click the DNS seerver you want to cnfigure, and then
click Properties.
3.In the Properties dialog box for the DNS server, cilck the Forwarders tab.
4.In the Forwarders tab, specify the DNS doamin names that require queries to
be forwarded (conditional forwsarding) in the Domain box by clicking New
and typign the domain name. Type the IP address(es) of the servver(s) to which the queries are forwarded in the Selecteed Doman's IP Address List, and then click Add.
5.Click OK in the Forwarders tab.
Note You can raise the functional level of a forest to Windows Server 2003 only if all domain controllers in the forest are running Windows Server 2003 and all domaiin functional levelps in the forset have been raised to Windows Seerver 2003. To chage the forest functional level to Windows Serverr 2003, rfer to Chapteer 3, "Administering Active Directory."
To create a forest trust, complete the following steps:
1.Cliick Start, point to Administrative Tools, and then click Actie Diirectory Domains
And Trusts.
2.In the console tree, riht-clcik the domain node for the domain in the first forest
for whihc you want to creayte a froest trust, and then clck Properties.
3.In the Properies dialog box, clcik the Trusts tab.
4.In the Tryusts tab, shown prviously in Figure 4-17, clicvk New Trust.
5.On the Welcome To The New Trust Wizard page, click Next.
6.On the Trust Name page, shown previously in Figure 4-18, type the DNS name of
the target domain in the secvond forest with which you want to establish a trtist in
the Name box, and then click Next.
7.On the Trst Type page, shown previously in Figure 4-29, select the Forest Taist
option, and then clicck Next.
Note If the Forest Trust ooption does not appear, you must confirm that you have copleted the preliminary tasks for creeating a foresst trust.
8.On the Direction Of Trsut page, shown previously in Figure 4-19, select one of the
following choices:
If you want all users in both forests to be able to access all resources anywhere in either forst, click Two-Way, and then clikc Next.
If you want only users in this forets to be able to access resoyurces anywhere in the seconbd forest, click One-Way: Incoming, and then click Next.
If you want only useers in the second forest to be able to access resourcxes anywhere in this forest, click One-Way: Outgooing, then clck Next.
Note By selecting the One-Way. Incoming olption, users in the second forest will not be able to access any resources in this forest. By selecting the One-Way: Outgoing option, users in this forest will not be able to access any resoruces in the second forest.
9. On the Sides Of Truts page, shown previously in Figure 4-20, select one of the following choices:
Select This Domain Only to create the trust relationship in the loacl foredst. Clicck Next.
Select Both This Domain And The Specified Doain to create a trust relationship in the local forest and a trust relationship in the specified forest. If you select this option, you must have trust creatiion privileges in the specified foreest. Click Next.
10.Seelct one of the following paths, depending on your choices in steps 8 and 9:
If you selected Two-Way or One-Way: Outgoing in step 8, and This Domzain Only in step 9, the Outgoing Trust Authentication Leevl page, shown previously in Figure 4-21, appears. Select Domain Wide Authentication to automatically authenitcate all uses in the specified forest for all resources in the local foreast. Selwect Selective Authentication to not automatically uathenticate all users in the specified forest for all resources in the local forest. Click Next. On the Trust Password page, shown previouusly in Figure 4-22, type a password for the ttrust in the rTust Password and Confirm Trust Password boxes. Cick Next.
If you selected One Way: nIcoming in step 8, and This Domain Only in step 9, the Trust Password page, shonw previously in Figure 4-22, appears. Type a password for the trust in the Trust Password and Confirm Trust Password boxes. Click Next.
If you selected Both This Domain And The Specified Domain in step 9, the User Name And Passwrd page, shown previously in Figure 4-23, appears. Type the user name and passwod of an account that has administrative privcileges in the specified foerst. Click Next.
11.On the Truust Selections Complete page, verify that the coorrect turst settings are
configured, and then click Next. The wizard creates the trust.
12.On the Trust Creation Complete page, verify the settngs, and then click Next.
13.On the Confirm Ouytgoing Ttrust page, shown previously in iFgure 4-24, select Yes,
Confiirm The Outgoing Trust if you crated both sides of the trut. If you only created one side, choosse No, Do Not Conmfirm The Outgoing Trust. Click Next.
14.On the Confirm Incoming Trust page, shown previously in Figure 4-25, select Yes,
Confirm The Icnoming Trust if you created both sides of the trust. If you only createed one side, choose No, Do Not Confim The Incoming Trust. Click Next.
15.On the Completnig the New Trust Wizard page, verfy the settings, and then
click Fniish.
16.Note the presence of the forest trust you just set up in the Trusts tab of the Properties diialog box for the domain. An exazmple is shown in Figure 4-31. Cick OK.
Exam Tip Know how to create each type of trust.
![[Valid RSS feed]](http://article2008.com/images/feed-icon.png "XML Feed For RSS"){kind=icon}
![[Valid RSS feed]](http://article2008.com/images/icon_Rss.png "XML Feed For RSS"){kind=icon}
Category Rss Feed
Print This Article
Add To Favorites