Re: External trusts between domains are there any risks?

Well you don't specify the direction of the trust which makes a difference but either way there can be information disclosure risks. In one direction you can enumerate every account/computer a domain has, in the other you can access file shares and applications that depend on Windows security that aren't properly secured.

If your plans are to join the W2K domain in the future, you will take your queues from the admins of the W2K domain, that is how you will get in. So whatever mechanism they specify is what you will use.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



Krusty wrote:
Question about using external trusts between domains?

I have a WIN2k and NT4 domains and need to have a one way trust setup between the two. I am admin on the NT4 domain but not the Win2k domian. The WIN2k admin refuses to put the trust in place, they say this is due to security risks but refuse to identify or expand on exactly what these are.
Can anyone enlighten me as to what the security risks are, and if it would cause issues if we were to migrate the NT4 domain to the Win2K domain in the near future?

Thanks In advance.
Krusty
.

Relevant Pages

  • Re: creating one way trust
    ... I'll start to move out the schema owner and domain role owner from the win2k ... For the trust, ... should i raise the Forest Functional Level or Domain functional level? ... My first DC in my domain is a win2k svr, ...
    (microsoft.public.windows.server.active_directory)
  • Re: External trusts between domains are there any risks?
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... You could always put the data in your domain and enable the trust the other way round. ... domain i dont get why my win2k admins are having a fit over the share....... ... I am admin on the NT4 domain but not the Win2k domian. ...
    (microsoft.public.windows.server.active_directory)
  • Re: External trusts between domains are there any risks?
    ... The trust is to allow the NT4 domain users to access limited resources in the WIN2k domai, this will be file shares on a single server. ... In one direction you can enumerate every account/computer a domain has, in the other you can access file shares and applications that depend on Windows security that aren't properly secured. ...
    (microsoft.public.windows.server.active_directory)
  • Re: External trusts between domains are there any risks?
    ... The trust relationship you want is the wrong way round. ... domain i dont get why my win2k admins are having a fit over the ... Joe Richards Microsoft MVP Windows Server Directory Services ... I am admin on the NT4 domain but not the Win2k ...
    (microsoft.public.windows.server.active_directory)
  • Re: General Network Security question
    ... One solution may be to use a stand alone computer that is ... Then you or those you trust 100 percent would be local administrators. ... You can use EFS in Windows XP Pro and Windows 2003 to share ... EFS has it's own risks however and should not be used ...
    (microsoft.public.security)