Windows Server 2019 Administration Fundamentals - Second Edition

Understanding trust relationship

In AD, there is a trust relationship between a computer and a DC and between domains, too. That being said, once a computer joins a domain, the Security Account Manager (SAM) in the local computer trusts the AD's authentication mechanism, which is a Kerberos in a DC. Hence, the user is being authenticated by a DC in a network and not from the local SAM.

Similarly, the authentication mechanism of each tree domain is trusting every other authentication mechanism of other trusted tree domains within a forest. From Figure 5.7, if a user is authenticated by Dautti.local, then its authentication is accepted by ITTrainings.local too, since these tree domains are part of the same forest (that is, the root domain),  ...