Active Directory trusts: forest trusts and selective authentication

Start DC01 and SRV01. You’ll create PDC1 from your laptop, then work on DC01 as SAATLAB\adm.rahul in PowerShell as administrator.

1Create and install PDC1

On your laptop:

VBoxManage createvm --name PDC1 --ostype Windows2025_64 --basefolder C:\Lab\VMs --register --default
VBoxManage modifyvm PDC1 --memory 2048 --cpus 2 --nic1 natnetwork --nat-network1 LabNet
VBoxManage createmedium disk --filename C:\Lab\VMs\PDC1\PDC1.vdi --size 40960
VBoxManage storageattach PDC1 --storagectl SATA --port 0 --device 0 --type hdd --medium C:\Lab\VMs\PDC1\PDC1.vdi
VBoxManage storageattach PDC1 --storagectl SATA --port 1 --device 0 --type dvddrive --medium C:\Lab\ISO\server2025.iso
VBoxManage startvm PDC1

Install Windows Server 2025 Datacenter Evaluation (without Desktop Experience), set the Administrator password, and choose 15 in sconfig to reach PowerShell.

On PDC1, configure the network and build the partner forest:

New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 10.0.0.30 -PrefixLength 24 -DefaultGateway 10.0.0.1 | Out-Null
Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 127.0.0.1
Rename-Computer -NewName PDC1 -Restart

After the restart, on PDC1:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools | Out-Null
Install-ADDSForest -DomainName partner.internal -DomainNetbiosName PARTNER -InstallDns -Force

Enter a DSRM password when asked. PDC1 restarts as the first DC of partner.internal. Sign in as PARTNER\Administrator afterwards.

✅ Checkpoint: PDC1 is the DC of partner.internal at 10.0.0.30.

2Make each forest resolve the other

On DC01:

Add-DnsServerConditionalForwarderZone -Name partner.internal -MasterServers 10.0.0.30 -ReplicationScope Forest
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.partner.internal | Select-Object NameTarget

On PDC1:

Add-DnsServerConditionalForwarderZone -Name saatlab.internal -MasterServers 10.0.0.10, 10.0.0.11
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.saatlab.internal | Select-Object NameTarget

You should see something like this (on DC01, then PDC1):

NameTarget
----------
PDC1.partner.internal

NameTarget
----------
DC01.saatlab.internal
DC02.saatlab.internal

A conditional forwarder sends queries for one domain to specific DNS servers. With -ReplicationScope Forest it’s stored in AD, so DC02 gets it too. Trusts fail without this step more often than for any other reason.

✅ Checkpoint: Each forest finds the other’s DC SRV records.

3Create and verify a two-way forest trust

On DC01, create the trust with the partner forest’s admin credentials:

$cred = Get-Credential PARTNER\Administrator
$ctx = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', 'partner.internal', $cred.UserName, $cred.GetNetworkCredential().Password)
$partner = [System.DirectoryServices.ActiveDirectory.Forest]::GetForest($ctx)
$local = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$local.CreateTrustRelationship($partner, 'Bidirectional')
Get-ADTrust -Filter * | Select-Object Name, Direction, ForestTransitive, SelectiveAuthentication, SIDFilteringForestAware

You should see something like this:

Name             Direction     ForestTransitive SelectiveAuthentication SIDFilteringForestAware
----             ---------     ---------------- ----------------------- -----------------------
partner.internal BiDirectional True             False                   False

The command created both sides of the trust at once, which needs admin rights in both forests. In real life, each company’s admins often create their own side with domain.msc (Active Directory Domains and Trusts) using a shared trust password.

Verify it:

netdom trust saatlab.internal /domain:partner.internal /verify /twoway /UserO:PARTNER\Administrator /PasswordO:*

You should see something like this:

Type the password associated with the object user:
The trust between saatlab.internal and partner.internal has been successfully verified
The command completed successfully.

✅ Checkpoint: Get-ADTrust shows a BiDirectional forest trust and netdom verifies it.

4Turn on selective authentication and allow only SRV01

On PDC1, create a partner user and group:

New-ADGroup -Name GG_Partners -GroupScope Global -GroupCategory Security
New-ADUser -Name 'Anil Kumar' -SamAccountName anil.kumar -UserPrincipalName anil.kumar@partner.internal -AccountPassword (Read-Host -AsSecureString 'Password') -Enabled $true
Add-ADGroupMember GG_Partners -Members anil.kumar

On DC01, require selective authentication for partner users, then allow GG_Partners on SRV01 only:

netdom trust saatlab.internal /domain:partner.internal /SelectiveAuth:Yes
dsacls "CN=SRV01,OU=Servers,OU=SAATLAB,DC=saatlab,DC=internal" /G "PARTNER\GG_Partners:CA;Allowed to Authenticate"
Get-ADTrust partner.internal | Select-Object Name, SelectiveAuthentication

You should see something like this (after dsacls lists the permissions):

Selective Authentication for this trust has been enabled.
The command completed successfully.
...
The command completed successfully

Name             SelectiveAuthentication
----             -----------------------
partner.internal                    True

Now partner users can authenticate to SRV01 and nothing else in saatlab.internal. “Allowed to Authenticate” is a control access right (CA) on the computer object; you can also set it on the Security tab of SRV01 in ADUC with Advanced Features on.

✅ Checkpoint: SelectiveAuthentication is True and GG_Partners has Allowed to Authenticate on SRV01.

5Give partner users a share on SRV01 and test it

On SRV01:

New-Item -ItemType Directory D:\Shares\Partner -Force | Out-Null
icacls D:\Shares\Partner /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F" "PARTNER\GG_Partners:(OI)(CI)M" | Out-Null
New-SmbShare -Name Partner -Path D:\Shares\Partner -ChangeAccess 'PARTNER\GG_Partners' -FullAccess 'SAATLAB\Domain Admins' | Out-Null

On PDC1, connect as Anil and write a file:

$anil = Get-Credential PARTNER\anil.kumar
New-PSDrive -Name P -PSProvider FileSystem -Root \\SRV01.saatlab.internal\Partner -Credential $anil | Out-Null
'Delivery schedule for October' | Set-Content P:\schedule.txt
Get-ChildItem P:\ | Select-Object Name

You should see something like this:

Name
----
schedule.txt

✅ Checkpoint: Anil from partner.internal wrote schedule.txt to the Partner share on SRV01.