Skip to content
Hermes Codex

Types of Active Directory Trusts

Concept

Section titled “Concept”

Active Directory supports six distinct trust relationship types, each serving specific enterprise architecture requirements and operating under different security boundaries:

Trust TypeScopeTransitivityDefault SID FilteringCreation
Parent / ChildIntra-forestTransitiveDisabled (Permissive)Automatic
Tree-RootIntra-forestTransitiveDisabled (Permissive)Automatic
ShortcutIntra-forestTransitiveDisabled (Permissive)Manual (Optimization)
ForestInter-forestTransitive (2 forests)Enabled (Strict)Manual
ExternalInter-forest / NT4Non-transitiveEnabled (Strict)Manual
RealmAD to non-WindowsConfigurableEnabled (Strict)Manual (Linux/MIT)

Why It Matters in DFIR

Section titled “Why It Matters in DFIR”

Accurate trust classification defines the scope of forensic containment and blast radius assessment:

  • Intra-Forest vs Inter-Forest: If a compromised domain is connected via a Parent-Child, Tree-Root, or Shortcut trust, escalation to the forest root is straightforward (SID Filtering disabled by default). If the connection is a Forest or External trust, SID Filtering blocks direct elevation via sIDHistory.
  • Shortcut Trusts: Frequently overlooked by defensive teams, shortcut trusts are manually created by administrators to speed up Kerberos authentication between distant domain branches. In DFIR, they serve as high-speed lateral movement bypasses.
  • External Trusts: Point-to-point connections between two specific domains across different forests. They are strictly non-transitive.

How It Works

Section titled “How It Works”

Breakdown of the 6 Trust Types

Section titled “Breakdown of the 6 Trust Types”
  1. Parent-Child:
    • Automatically established when joining a child domain to an existing domain tree.
    • Contiguous DNS namespace (sub.domain.local and domain.local).
    • Two-way and transitive across the forest.
  2. Tree-Root:
    • Automatically established when adding a new domain tree with a distinct DNS root (brand.com) to an existing forest (corp.local).
    • Two-way and transitive across the forest.
  3. Shortcut Trust:
    • Manually provisioned between two distant domains in the same forest to optimize the Kerberos referral path.
    • One-way or two-way, transitive intra-forest.
  4. Forest Trust:
    • Established between the forest root domains of two separate forests (functional level 2003+).
    • Enables transitive authentication across all domains of both forests.
    • Strictly enforces SID Filtering and Name Suffix Routing.
  5. External Trust:
    • Manually created between a domain in one forest and a domain in another forest (or legacy Windows NT 4.0).
    • Strictly non-transitive: accounts from the remote domain can only access resources in the local domain, with no further hops permitted.
  6. Realm Trust:
    • Established between Active Directory and a non-Windows Kerberos KDC (e.g., MIT Kerberos, FreeIPA).

What Is Possible

Section titled “What Is Possible”
  • Granular Classification via LDAP Attributes: Inspecting trustType (1=NT4, 2=Upx/AD, 3=MIT Kerberos) and trustAttributes (bitmask flags) reveals exact trust operational parameters.
  • Enterprise-Wide Traversal Across Forest Trusts: A user in Forest A can authenticate to resources in any domain of Forest B if appropriate ACLs are granted.
  • Detecting Dormant M&A Trusts: Uncovering unmanaged legacy trusts from historical mergers and acquisitions that serve as attacker backdoor channels.

What Is Not Possible

Section titled “What Is Not Possible”
  • Hopping Past an External Trust: An attacker compromising Domain A linked via an External Trust to Domain B cannot pivot to Domain C (parent of B) through that trust.
  • Forging High-Privilege SIDs Across Forest Trusts: SID Filtering sanitizes foreign SIDs from PAC structures crossing forest boundaries.

Common DFIR Confusions

Section titled “Common DFIR Confusions”
Frequent ConfusionVerifiable Forensic Reality
”A Forest Trust is simply an External Trust between two forests.”False. An External Trust is non-transitive between two specific domains. A Forest Trust is transitive across all domains of both forests.
”Shortcut trusts grant new security permissions.”They grant zero additional permissions; they merely optimize the Kerberos referral network path.
”Realm trusts allow Group Policy enforcement on Linux endpoints.”Realm trusts only provide Kerberos authentication interoperability, not Active Directory object management or GPO delivery.

Concrete Forensic Example

Section titled “Concrete Forensic Example”

During an incident response investigation, the DFIR team uncovers an unknown trust:

  • BloodHound identifies a trust link from production to an unknown forest managed-service-provider.local.
  • TDO inspection reveals:
    • trustType: 2 (Active Directory)
    • trustAttributes: 0x8 (TRUST_ATTRIBUTE_FOREST_TRANSITIVE)
    • trustDirection: 2 (Outbound: production trusts the service provider).
  • Forensic Assessment: Any compromised identity inside the service provider forest could authenticate to production resources enterprise-wide.

Key Forensic Artefacts

Section titled “Key Forensic Artefacts”
  1. trustAttributes Bitmask Values:
    • 0x00000001: NON_TRANSITIVE
    • 0x00000002: UPLEVEL_ONLY (Windows 2000+)
    • 0x00000004: QUARANTINED_DOMAIN (SID Filtering enforced)
    • 0x00000008: FOREST_TRANSITIVE (Forest Trust)
    • 0x00000020: WITHIN_FOREST (Intra-forest trust)
    • 0x00000040: TREAT_AS_EXTERNAL
  2. DC Security Event Logs:
    • Event ID 4706: A trust relationship to a domain was created.
    • Event ID 4707: A trust relationship to a domain was removed.
    • Event ID 4716: A trust relationship attribute was modified.

Investigation Methods

Section titled “Investigation Methods”
  1. Enumerate All Trust Objects and Attribute Bitmasks: Use PowerShell to inspect raw trustAttributes values on all trustedDomain objects.
  2. Review Historical Trust Management Events: Query PDC Emulator security logs for Event IDs 4706, 4707, and 4716.
  3. Verify Selective Authentication Enforcement: Check whether TRUST_ATTRIBUTE_CROSS_ORGANIZATION (0x10) is active, requiring explicit Allowed-To-Authenticate permissions on target computers.

Investigative Tooling

Section titled “Investigative Tooling”
  • PowerShell AD Module:
    Terminal window
    Get-ADObject -Filter 'objectClass -eq "trustedDomain"' -Properties * |
      Select-Object Name, trustDirection, trustType, trustAttributes, whenCreated, whenChanged
  • Netdom:
    Terminal window
    netdom trust <DomainName> /Enum
  • BloodHound: Query: Match (n:Domain)-[:TrustedBy]->(m:Domain) Return n, m to map all trust relationships and directions.

Key Takeaways

Section titled “Key Takeaways”
  • Intra-forest trusts are transitive and do not filter SIDs by default.
  • Forest trusts are transitive between two forests and enforce strict SID filtering.
  • External trusts are strictly non-transitive.
  • Any rogue trust establishment generates Event ID 4706 on the PDC Emulator.

References & Further Reading

Section titled “References & Further Reading”