Share via


Create a shortcut trust

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To create a shortcut trust

  • Using the Windows interface

  • Using a command line

Using the Windows interface

  1. Open Active Directory Domains and Trusts.

  2. In the console tree, right-click the domain node for the domain you want to establish a shortcut trust with, and then click Properties.

  3. On the Trusts tab, click New Trust, and then click Next.

  4. On the Trust Name page, type the DNS name (or NetBIOS name) of the domain, and then click Next.

  5. On the Direction of Trust page, do one of the following:

    • To create a two-way, shortcut trust, click Two-way.

      Users in this domain and users in the specified domain can can use this trust path.

    • To create a one-way, incoming shortcut trust, click One-way:incoming.

      Users in the specified domain will not be able to use this trust path.

    • To create a one-way, outgoing shortcut trust, click One-way:outgoing.

      Users in this domain will not be able to use this trust path.

  6. Continue to follow the wizard.

Notes

  • To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.

  • To open Active Directory Domains and Trusts, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Domains and Trusts.

  • If you have the appropriate administrative credentials for each domain, you can create both sides of a shortcut trust at the same time by clicking Both this domain and the specified domain on the Sides of Trust page. For more information, see Related Topics.

Using a command line

  1. Open Command Prompt.

  2. Type:

    netdom trustTrustingDomainName**/d:TrustedDomainName/add**

Value Description

TrustingDomainName

Specifies the DNS name (or NetBIOS name) of the trusting domain in the trust being created.

TrustedDomainName

Specifies the DNS name (or NetBIOS name) of the domain that will be trusted in the trust being created.

Notes

  • To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • This command-line method requires the Netdom Windows support tool. For information about installing Windows support tools, see Related Topics.

  • Other switches can be used to assign a password or determine the direction of the trust. For example, to make the above trust a two-way, transitive trust you would use the following syntax:

    netdom trustTrustingDomainName**/d:TrustedDomainName/add/twoway**

  • To view the complete syntax for this command, at a command prompt, type:

    netdom trust | more

Information about functional differences

  • Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.

See Also

Concepts

When to create a shortcut trust
Trust types
Trust direction
Runas
Using Run as
Install Windows Support Tools