Junk

Ask something
Question Locked

Active Directory Groups

0 helpful
6 replies

by gtechstuff

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I was presented with an interesting question.

I had someone trying to add users from a domain that we have a trust set up with to a universal group in our domain.

When they went to add the users, the clicked the add button button on the members tab clicked the advance tabe and clicked other locations. They were assuming that we could see the other domains we have a trust with but they could only see our own domain.

As a test, I created a domain local group and went through the same process. When I clicked on the other locations button, I was able to see all of the domains that we have a trust set up with.

Can anyone tell me what the situation is with this?

These are not subdomains in a forest. If anyone has any good links about this type of situation I would like to do the reading on this.

Thanks,

6 replies

by gtechstuff

If that is the case why would I see the domains when I create a domain local group but not with global or universal group.

that doesn't really make sense. If there is a trust not set up I wouldn't be able to see anything across the board would I?

by cg it

if one has domain administrative rights, sure they will be able to see whatever in AD Domains and Trusts.

If you create a one way trust, then the rights and permissions assigned to groups or users only work 1 way. A trusts B but B doesn't trust A then only B will access A. A won't be able to access B and so on.

by gtechstuff

If that is the case why would I see the domains when I create a domain local group but not with global or universal group.

that doesn't really make sense. If there is a trust not set up I wouldn't be able to see anything across the board would I?

by cg it

then you shouldn't see anything from another domain if whomever setup the network did it right.

Again, trusts are, in a nut shell, a matter of rights and permissions.

Example: if you have an enterprise with a multiple forests with multiple domains, the enterprise admins can setup rights and permissions that domain admins can only administer the domain they are in. This is regardless of trusts.

Domains are security boundries. Domains with child domains have an inherent transitive 2 way trust between them, however a domain is a security boundry, therefore even with a trust relationship established, users wanting to access another domain must be granted rights and permissions to do so.

This discussion is closed to new replies.