Transitivity of trust when adding new domain

Question

Suppose I have a domain trust between domain A(forest A), and domain B(forest B) (bi-directional, FOREST TRANSITIVE).

Assuming I add domain C to forest A. At this point A trusts C, and B should trust C. But how does domain B knows about domain C? What are the transactions? How does the configuration change ? Is new domain trust added by B?

Alternatively, if domain B doesn't know about C, it simply trusts any domain information given by A? (for example ValidationInformation structure that is part of PAC)

Answer 1

Propagation depends if your initial configuration was considering that or not.

The initial step is to configure a trust relationship between the new domain and at least 1 of the others.

First configure domain C to allow domain A to trust it, and then configure domain A to trust domain C:

• Log onto domain C as Administrator.

• Start User Manager for Domains (Start - Programs - Administrative Tools).

• Select "Trust Relationships" from the Policies menu.

• Click the Add button to the Trusting Domains box.

• Enter the name of the domain you want to be able to trust you, i.e. domain A. You can type a password in the Initial Password and Confirm Password, however this is only used when the trust relationship is started. You can leave it blank Click OK to complete the addition.

• Close the Trust Relationship dialog box.

• Log off of domain C and logon onto domain A as Administrator.

• Start User Manger for Domains, and choose "Trust Relationships" from the Policies menu.

• Click the Add button to the Trusted Domains box.

• Enter the name of domain C and the password if one was configured in step 6.

• Click OK and close the User Manager for Domains application.

Domain A now trusts domain C.

If your initial configuration was not that good and trust does not propagate to domain B, you will have to do some advanced tweaking.

You can find a very detailed guide here .