In some cases trust can present security issues.
Additionally if you do not configure a trust properly.
Users who belong to another domain can gain unwanted access to some resources.
Several technology technologies can help you to control and manage security in a trust.
Let's start with seed filtering by default.
When you establish a forest or domain trust you can only enable a domain current team which is also
known as seed filtering.
When a user authenticate in a trusted domain the user presents authorization data that includes the
seeds of all of the groups to which the user belongs.
Additionally the users oath and authorization data includes the seed history of the user and the user's
groups set filter and prevents misuse of the seed history attribute by allowing reading of the seed
only from the object set attribute and not the seed history attribute in a trusted domain Siniora.
The administrator can use administrative credentials in the trusted domain to load seats that are the
same as seats of privileged accounts in your domain into the seed history attribute of a user that the
user would then have inappropriate levels of access to resources in your domain.
Seed filtering prevents this by enabling the trust and domain to filter out seeds from the trusted domain
that are not the primary seeds of the security principles.
Each seed includes the seat of the originated domain.
So when a user from a trusted domain presents the lists of the users seats and the seats of the users
groups seed filter and instructs the trust and domain to discard all suits without the domain C of the
trusted domain so set filter and is enabled by default for all out go entrusts to external domains and
forests and other technology that can help you to control and manage security in a thrusters.
Selective authentication.
When you create an external trust or a forest trust you can manage the scope of authentication of trusted
security principles.
There are two modes of authentication for an external or Forest Trust domain wide authentication for
an external trust or forest wide authentication for a Forest Trust and selective authentication.
Choosing domain white or forest white authentication enables all trusts trusted the users to authenticate
for services and access on all computers and the trusted domains therefore trusted.
Users can be given permission to access the resources anywhere in the trust and domain.
If you use this authentication mode all users from a trusted domain or forest are considered authenticated
users in the trust and domain last.
If you choose domain white or forest white authentication any resource that has permissions granted
authenticated users is accessible immediately to trust and sorry to trusted the main users.
If you choose selective authentication all users since a trusted domain are trusted identities.
However they are allowed to authenticate only for services on computers that you specify when they use
selective authentication.
Users will not become authenticated users in the target domain but you can explicitly grant them the
allowed to authenticate permission on specific computers.
For example imagine that you have an external trust with a partner organizations domain you want to
ensure that only users from the partner organisations marketing group can access shared folders on only
one of your many file servers.
You can configure selective authentication for the trust relationship.
You can then give the trusted users the right to authenticate only for that one file server the next
technology that can help you control and manage security in a drugstore is name suffix rout.
Name suffix routing is a mechanism for managing our authenticated requests route across forests run
and Windows Server 2003 or newer that are joined by forest trusts to simplify the administration of
authentication requests.
When you create a Forest Trust Edit Yes the roads all unique names suffixes by default a unique name
suffix is a name suffix within a forest such as a European suffix as and suffix or DNS forest or domain
tree name that is not subordinate to any other name suffix.
For example the genus forest name for brick and dot com is a unique name suffix within the four broken
dot com forest aided years routs.
All names that are subordinate to unique names suffixes implicitly for example if you your forest users
for brick and dot com as a unique name suffix authentication request for all child demands of a brick
and dot com which is child demand for broken dot com are rounded because the child domains are part
of the fabric and dot com name suffix child.
Names appear in the Active Directory domains and trusts snap in.
If you want to exclude members of a child demand from authenticate in a specified forest you can disable
name suffix Rudin for that name.
You can also disable routing for the forest name itself.
Now if you want to additionally read some more information about these technologies you can use these
links and read more about seed filtering enabling selective authentication of the Forest Trust and read
about.
SUFFIX root.
Please refer to this links.