Active Directory Cookbook

2.17. Creating a Shortcut Trust Between Two AD Domains

Problem

You want to create a shortcut trust between two AD domains in the same forest or in different forests. Shortcut trusts can make the authentication process more efficient between two domains in a forest.

Solution

Using a graphical user interface

1. Open the Active Directory Domains and Trusts snap-in.

2. In the left pane, right-click the domain you want to add a trust for, and select Properties.

3. Click on the Trusts tab.

4. Click the New Trust button.

5. After the New Trust Wizard opens, click Next.

6. Type the DNS name of the AD domain and click Next.

7. Assuming the AD domain was resolvable via DNS, the next screen will ask for the Direction of Trust. Select Two-way and click Next.

8. For the Outgoing Trust Properties, select all resources to be authenticated and click Next.

9. Enter and retype the trust password and click Next.

10. Click Next twice.

Using a command-line interface

> netdom trust <Domain1DNSName> /Domain:<Domain2DNSName> /Twoway /ADD[RETURN]
         [/UserD:<Domain2AdminUser> /PasswordD:*][RETURN]
         [/UserO:<Domain1AdminUser> /PasswordO:*]

To create a shortcut trust from the emea.rallencorp.com domain to the apac.rallencorp.com domain, use the following netdom command:

> netdom trust emea.rallencorp.com /Domain:apac.rallencorp.com /Twoway /ADD[RETURN]
         /UserD:[e-mail] /PasswordD:*[RETURN]
         /UserO:[e-mail] /PasswordO:*

Discussion

Consider the forest in Figure 2-6. It has five domains in a single domain tree. ...