Networks

humm. you don't need to "break" the transitive trust, then try to setup an one way to keep net2.local users out of net1.local users. I think the term trust tends to be a misnomer or mistook for allowing access to resources lickty split. It doesn't. The trust established between domains within the same domain namespace can be configured to allow only those with permissions to access shared resources. Thats what makes AD pretty neat. you can have a bunch of different "sites" all their own seperate domains [within the root domain namespace]with their own DC's and whatnot, but each one can't access others shared resources without explicit permission to do so. Even the Admin accounts. But should the need arise, you can allow individual users from one site to access specific AD resources at another site. Limit that access for a specific time period and limit what they do.