Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Is SID Filtering relevant to forest trusts?

April 26, 2017filtering forest relevant SID trusts

0

Posted

Is SID Filtering relevant to forest trusts?

1 Answer

0

Posted

Yes. SID filtering is available on forest trusts, and does not appear to be on by default. It can be configured using: netdom trust /D: /quarantine [yes|no] Because sid filtering allows only SIDs from the trusted domain to carry over into the trusting domain, it appears that it can break the transitivity of a forest trust. For example, if you had two forests with a forest trust between the forest root domains, and you expected a SID from a child domain in one forest to be usable in the other forest, this fails if SID Filtering is enabled.