Windows 2000 Forest Tree Trust Relationships

In Microsoft Windows 2000 Active Directory, trust relationships determine how security principals in one domain access resources in another. When handling trusts between different domain trees within the same forest, Windows 2000 uses automatic, two-way transitive trusts anchored at the forest root domain via Kerberos v5 authentication. Conversely, when communicating across entirely separate forests, Windows 2000 does not support transitive forest trusts; it instead requires administrators to establish explicit, one-way or two-way non-transitive external trusts between individual domains.

Automatic Tree-Root Trusts Within a Forest

When a new domain tree is added to an existing Windows 2000 forest, Active Directory automatically creates a tree-root trust. This is a two-way, transitive trust established directly between the root domain of the new tree and the forest root domain.

Because tree-root trusts are transitive and use Kerberos v5:

  • Every tree root in the forest trusts the forest root domain.
  • Trust flows transitively through the forest root to all other domain trees in the forest.
  • Child domains within each tree automatically trust their parent domains, completing an unbroken path of trust between any domain in Tree A and any domain in Tree B.

Users do not require administrative intervention to access resources across different trees within the same forest, provided permissions are granted.

Shortcut Trusts for Optimization

In complex forest topologies with deep hierarchies, authentication requests between domains in different trees must traverse up to the root domain of the first tree, cross the tree-root trust to the forest root, and traverse down the target tree.

To optimize this traffic, Windows 2000 allows administrators to configure shortcut trusts (also known as cross-link trusts). A shortcut trust is a manually created, transitive trust between two specific domains in different trees within the same forest. This bypasses the complete hierarchy, speeding up Kerberos authentication and ticket-granting ticket (TGT) referrals.

Trust Relationships Between Separate Forests

Windows 2000 handles trusts between distinct Active Directory forests differently than later versions of Windows Server:

  • No Forest Trusts: Windows 2000 does not natively support forest-level trusts (a feature introduced in Windows Server 2003).
  • Explicit External Trusts: To allow users in a tree of Forest A to access resources in a tree of Forest B, administrators must manually create an explicit trust between the specific domains involved.
  • Non-Transitive Nature: These external trusts are strictly non-transitive and use NTLM authentication rather than Kerberos. Trust established between Domain A (in Forest A) and Domain B (in Forest B) does not extend to child domains or other trees in either forest. Each domain requiring cross-forest access must have its own distinct trust relationship configured.