RE: AD Child Domains

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of Raoul Armfield
Sent: Wednesday, April 23, 2008 2:43 PM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: AD Child Domains

We are in the process of making a modification to our AD structure.
For
PCI compliance we need to segregate a portion of our users to a
separate
domain. This set of users do not need/want (and are very vocal about
it) to follow the stricter password policy that PCI mandates.

I understand that when you create a child domain it by default creates
a
two-way transitive trust between the two domains. Is it possible to
limit this trust relationship to a one-way trust relationship? If this
is possible it seems to me that it may be preferable to creating a new
forest just for a couple of hundred users.

Of course it is entirely possible that I am not thinking this through
completely and am missing some important factors to consider. Your
thoughts would be greatly appreciated.

Raoul

There is no way (that I know of) to selectively configure the transitive
trust established between a parent/child domain. I am not fully
understanding what you are trying to accomplish other than using a separate
password policy which a child domain will allow. Only use a separate forest
to meet a security need. And again I would be evaluating if it could be
done with a DACL. It becomes much more complicated and time consuming to
manage two forests then to manage a parent/child Domain.

Relevant Pages

  • Re: Child domain security
    ... How would we be able to stick with a similar namespace with a separate ... for example would we still be able to have one forest be ... permissions that come with creating a child domain. ... there was a way to modify the trust relationship for further security ...
    (microsoft.public.windows.server.active_directory)
  • Re: Child Domain Questions W2K3
    ... The last question, if you let me, the user of child domain my.x.local, if he ... can log on the ours.x.local withou any trust relationship configured? ... must configure Short Trust RelationShip. ... AD all trusts in a forest are transitive. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Orphaned Child Domains into new forest
    ... I know you want to connect child domaininto a different forest. ... Connect the remote forest with your forest over WAN and create trust ... promote a DC of the remote child domain in your location. ... Orphaned Child Domains into new forest ...
    (microsoft.public.windows.server.migration)
  • Re: User autentification and access to "sister" domain resources
    ... You can do GP links across domains in the same forest. ... administrative accounts delegated to the OUs in the child domain. ... >, thanks for SUS answer. ... > And it isn't, of course, a comlpete list of reasons because of complexity ...
    (microsoft.public.win2000.active_directory)
  • Re: NTDS.dit security in 2003 child domain
    ... The Forest is the security boundary. ... Jorge will tell you this: give me access to any Domain Controller in the ... I have created a test child domain, ...
    (microsoft.public.windows.server.active_directory)