Windows 2000 Active Directory Domains and Trusts

In Microsoft Windows 2000, the Active Directory Domains and Trusts console is an administrative snap-in used to manage domain relationships, functional modes, and authentication pathways within an enterprise network. It serves as the primary tool for establishing and configuring trust relationships between domains, managing domain operating modes, assigning alternate User Principal Name (UPN) suffixes, and transferring the Domain Naming Master operations role.

Managing Trust Relationships

The core function of the Active Directory Domains and Trusts tool is creating and administering trusts between domains. While Windows 2000 automatically creates two-way, transitive Kerberos v5 trusts between parent and child domains in the same forest, administrators use this console to manage non-transitive or explicit trusts. This includes establishing external trusts with Windows NT 4.0 domains, non-forest Windows 2000 domains, or MIT Kerberos realms. Administrators can view, verify, and revoke existing trust relationships, ensuring secure cross-domain authentication and resource access.

Changing Domain Operating Modes

Windows 2000 domains initially install in "Mixed Mode" to allow interoperability with legacy Windows NT 4.0 Backup Domain Controllers (BDCs). Active Directory Domains and Trusts allows administrators to transition the domain to "Native Mode" once all domain controllers are upgraded to Windows 2000. Switching to Native Mode unlocks advanced Active Directory features, such as universal groups, nested group memberships, and the disabling of NetBIOS-based replication protocols. This conversion is a one-way, irreversible process executed directly within the properties of the domain inside the console.

Configuring Alternative UPN Suffixes

The tool provides a centralized interface for configuring alternative User Principal Name (UPN) suffixes for the entire forest. By default, a user's UPN suffix matches the DNS name of the domain where the user account resides (e.g., user@sales.example.com). Through Active Directory Domains and Trusts, administrators can add simplified or enterprise-wide UPN suffixes (e.g., user@example.com). This simplifies logon credentials across deep domain hierarchies and streamlines user administration.

Managing the Domain Naming Master Role

Active Directory relies on Flexible Single Master Operation (FSMO) roles to handle specific directory-wide tasks. The Active Directory Domains and Trusts tool manages the Domain Naming Master role. This role controls the addition or removal of domains and directory partitions across the forest, preventing duplicate domain names. Administrators can view which domain controller currently holds this role and transfer it to another domain controller when required for maintenance or server decommissioning.