PLAN ACTIVE DIRECTORY TESTOUT SERVER PRO 2016 IDENTITY

PLAN ACTIVE DIRECTORY TESTOUT SERVER PRO 2016: IDENTITY

Create and manage Active Directory trusts. Create a forest root trust. Design trusts. Create a shortcut trust. TESTOUT SERVER PRO 2016: IDENTITY

Shortcut External Realm Direction of Trust Security Identifier (SID) Direction of Resource Access Transitivity TESTOUT SERVER PRO 2016: IDENTITY

Shortcut: Shortcut trusts improve user logon times between two domains within a forest by reducing the amount of Kerberos authentication traffic on the network. Shortcut trusts are transitive and use Kerberos (a protocol for authentication). External: External trusts provide access to resources located on a Windows NT 4. 0 domain or a domain located in a forest that is not joined by a forest trust. External trusts are non-transitive and use NT LAN Manager authentication (NTLM) protocols. Realm: Realm trusts form a trust relationship between a non. Windows Kerberos realm and a Windows Server 2008 or later domain. Realm trusts can be transitive or non-transitive and use Kerberos. TESTOUT SERVER PRO 2016: IDENTITY

Direction of Trust: The direction of the arrow identifies the direction of trust. For example, if Domain A trusts Domain B, the arrow would point from Domain A to Domain B. Security Identifier (SID): A security identifier (SID) is a unique value of variable length used to identify each account. Direction of Resource Access: Resource access is granted opposite of the direction of trust. For example, if Domain A trusts Domain B, users in Domain B have access to resources in Domain A. Users in the trusted domain have access to resources in the trusting domain. Transitivity: Transitivity defines whether trust between domains flows or is inherited to other trusted domains. TESTOUT SERVER PRO 2016: IDENTITY

Trusts allow users to access resources in another domain. I need access to your share Share TESTOUT SERVER PRO 2016: IDENTITY Domain Corp User Domain ACME

Trusts allow users to access resources in another domain. Trust options include: One-way or two-way Domain Corp trusts Domain ACME Share TESTOUT SERVER PRO 2016: IDENTITY Domain Corp User Domain ACME

Trusts allow users to access resources in another domain. Trust options include: One-way or two-way Incoming or outgoing Transitive and nontransitive Domain Corp trusts Domain ACME Outgoing Trust Share TESTOUT SERVER PRO 2016: IDENTITY Domain Corp Incoming Trust User Domain ACME

Trusts allow users to access resources in another domain Trust options include One-way or two-way Incoming or outgoing Transitive Nontransitive TESTOUT SERVER PRO 2016: IDENTITY A trusts B and C B trusts C Domain A Domain B A trusts B B trusts C Domain A Domain B Domain C

Automatic Cross-forest External Realm Shortcut TESTOUT SERVER PRO 2016: IDENTITY

Corp. Net. com Forest Created when a new domain is added to a domain tree or forest root domain. Two-way Transitive Corp. Net. com Two-way Transitive West. Corp. Net. com TESTOUT SERVER PRO 2016: IDENTITY Net. Corp. com

Are manual trusts created between two forests. Must have a forest functional levels of Windows 2003 or higher. Forest C Forest A A B. A TESTOUT SERVER PRO 2016: IDENTITY C D. C

Are manual trusts created between two forests. Must have a forest functional levels of Windows 2003 or higher. No trust between Are nontransitive. domains A and C Forest A Forest B B trusts C A trusts B A B. A TESTOUT SERVER PRO 2016: IDENTITY Forest C B C C. A

Forest-wide: Permits unrestricted access by any users in the specified forest to all available shared resources. Enabled by default. Selective: Allows selected users and groups in remote forest to access resources in local forest. Must assign the Allowed to Authenticate right. TESTOUT SERVER PRO 2016: IDENTITY

Domain names are added to the Name Suffix Routing List at the creation of the trust. Domain names are removed to exempt a trust. New domains added after the trust creation must be added manually to the routing list. TESTOUT SERVER PRO 2016: IDENTITY

External Trust A nontransitive trust between domains in different forests Forest C Forest A A B. A TESTOUT SERVER PRO 2016: IDENTITY C D. C

External Trust A nontransitive trust between domains in different forests Realm Trust A nontransitive trust between an Active Directory domain and a Kerberos V 5 realm. TESTOUT SERVER PRO 2016: IDENTITY

Forest A A transitive trust between domains in the tree or forest. Used to shorten the trust path. Not required to traverse multiple trusts. A B. A D. A Shortcut Trust C. B. A TESTOUT SERVER PRO 2016: IDENTITY E. D. A

Trust Types Automatic Cross-forest External Realm Shortcut TESTOUT SERVER PRO 2016: IDENTITY

Do the following labs: 2. 4. 3 Create a Forest Root Trust 2. 4. 7 Design Trusts 2. 4. 8 Create a Shortcut Trust TESTOUT SERVER PRO 2016: IDENTITY

Which types of trusts are created automatically for domains within a forest? What are the characteristics of automatically created domain trusts? What are the characteristics of trusts between forests? When can forest trusts be used? When must you create an external trust? What advantages does selective authentication provide to system administrators for securing resources in a forest? TESTOUT SERVER PRO 2016: IDENTITY

How do shortcut trusts improve user logon times between two domains within a forest? What are the characteristics of an external trust? When should you use a realm trust? TESTOUT SERVER PRO 2016: IDENTITY