Trust Relationships

Windows NT Server directory services provide security across multiple domains through trust relationships. A trust relationship is a link that combines two domains into one administrative unit that can authorize access to resources on both domains.

There are two types of trust relationships:

• In a one-way trust relationship, one domain trusts the users in the other domain to use its resources. More precisely, one domain trusts the domain controllers in the other domain to validate user accounts to use its resources. The resources that become available are in the trusting domain, and the accounts that can use them are in the trusted domain. If user accounts located in the trusting domain need to use resources located in the trusted domain, that requires a two-way trust relationship.
• A two-way trust relationship is two one-way trusts: Each domain trusts user accounts in the other domain. Users can log on to their domain account from computers in either domain. Each domain can have its own accounts and resources. Global user accounts and global groups can be used from either domain to grant rights and permissions to resources in either domain.

Note

Using resources located on any domain, trusting or otherwise, is always subject to permissions associated with the resources.

Through File Manager, users from the trusted domain can be given rights and permissions to objects in the trusting domain, as if they were members of the trusting domain. Users in the trusted domain can browse resources in the trusting domain, subject to account privilege.

For example, suppose the London domain trusts the Topeka domain of a corporate network. User EmilyP, who is a member of the Topeka domain, wants to access Myfile.txt, which is a file located on a computer in the London domain running Windows NT Server. When EmilyP attempts to log on to the server in London, her user account information is not transferred to the London domain's user database. Because London trusts Topeka, the London domain has access to user information in the Topeka domain's user-account database.