Create a one-way, incoming, external trust for both sides of the trust

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

This procedure creates both sides of a one-way, incoming, external trust, and it requires you to have administrative credentials for your domain as well for the reciprocal domain. If you have administrative credentials only for your domain, you can use the procedure Create a one-way, incoming, external trust for one side of the trust to create your side of the trust. Then, have the administrator for the reciprocal domain create a one-way, outgoing, external trust from his or her domain.

A one-way, incoming, external trust allows users in your domain (the domain that you are logged on to at the time that you run the New Trust Wizard) to access resources in another Active Directory domain (outside your forest) or in a Windows NT 4.0 domain. For example, if you are the administrator of sales.wingtiptoys.com and users in that domain need to access resources in the marketing.tailspintoys.com domain (which is located in another forest) you can use this procedure to establish a relationship so that users in your domain can access resources in the marketing.tailspintoys.com domain.

You can create this external trust by using the New Trust Wizard in Active Directory Domains and Trusts or by using the Netdom command-line tool. For more information about how to use the Netdom command-line tool to create an external trust, see "Netdom.exe: Windows Domain Manager" in the Windows Server 2003 Technical Reference on the Microsoft Web site (https://go.microsoft.com/fwlink/?LinkId=41700).

Administrative credentials

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory.

To create a one-way, incoming, external trust for both sides of the trust

  1. Open Active Directory Domains and Trusts.

  2. In the console tree, right-click the domain that you want to establish a trust with, and then click Properties.

  3. On the Trusts tab, click New Trust, and then click Next.

  4. On the Trust Name page, type the Domain Name System (DNS) name (or network basic input/output system (NetBIOS) name) of the domain, and then click Next.

  5. On the Trust Type page, click External trust, and then click Next.

  6. On the Direction of Trust page, click One-way: incoming, and then click Next.

    For more information about the selections that are available on the Direction of Trust page, see the section "Direction of Trust" in Appendix: New Trust Wizard Pages.

  7. On the Sides of Trust page, click Both this domain and the specified domain, and then click Next.

    For more information about the selections that are available on the Sides of Trust page, see the section "Sides of Trust" in Appendix: New Trust Wizard Pages.

  8. On the User Name and Password page, type the user name and password for the appropriate administrator in the specified domain.

  9. On the Outgoing Trust Authentication Level--Specified Domain page, do one of the following, and then click Next:

    • Click Domain-wide authentication.

    • Click Selective authentication.

  10. On the Trust Selections Complete page, review the results, and then click Next.

  11. On the Trust Creation Complete page, review the results, and then click Next.

  12. On the Confirm Incoming Trust page, do one of the following:

    • If you do not want to confirm this trust, click No, do not confirm the incoming trust.

    • If you want to confirm this trust, click Yes, confirm the incoming trust, and then supply the appropriate administrative credentials from the specified domain.

  13. On the Completing the New Trust Wizard page, click Finish.