Windows 2000 Tree Root Trust Creation

In Microsoft Windows 2000 Active Directory, creating an inter-domain trust between tree roots depends on whether the domains belong to the same forest or separate forests. Within a single forest, Windows 2000 automatically establishes a two-way, transitive Kerberos trust between the new tree root and the forest root domain during the promotion process. When linking tree roots across different, disconnected forests, administrators must manually establish an explicit, non-transitive trust using NTLM authentication. This article outlines the architecture, protocols, and technical steps Windows 2000 uses to execute these trust relationships.

Tree-Root Trusts Within the Same Forest

When an administrator adds a new tree root to an existing Active Directory forest using the Active Directory Installation Wizard (dcpromo.exe), the operating system automatically links the new tree to the forest hierarchy:

  1. Enterprise Credential Validation: During domain controller promotion, the administrator provides credentials belonging to the Enterprise Admins group. This validates administrative authority across the entire forest.
  2. Shared Secret Generation: The primary domain controller (PDC) emulator of the new tree root and the PDC emulator of the forest root generate a mutually agreed-upon shared secret (a trust authentication password).
  3. Creation of Trusted Domain Objects (TDOs): Each domain creates a Trusted Domain Object (trustedDomain) within the System container of its domain directory partition. The TDO stores trust attributes, including the domain name, Security Identifier (SID), trust type (UPLEVEL), trust attributes (transitive), and the trust direction (two-way).
  4. Kerberos Trust Path Setup: Because both domains share a common schema, configuration container, and global catalog, Windows 2000 configures the trust to use Kerberos v5. Authentication requests between the trees traverse the root of the forest using Kerberos ticket-granting tickets (TGTs).

Because this trust is transitive, any child domains subsequently added under the new tree root inherit access paths to the rest of the forest through their parent domain.

Explicit External Trusts Between Different Forests

Windows 2000 does not support transitive cross-forest trusts (a feature introduced in Windows Server 2003). Therefore, creating a trust between tree roots in entirely separate forests requires an explicit external trust executed through the following process:

  1. Name Resolution: Domain controllers in both tree roots must be able to resolve each other's fully qualified domain names (FQDN) or NetBIOS names, typically achieved via DNS forwarders or WINS.
  2. Trust Initiation: The administrator opens the Active Directory Domains and Trusts console or executes the netdom trust command-line utility.
  3. Password Exchange: The administrator defines the trust direction (one-way incoming, one-way outgoing, or two-way) and supplies a shared trust password. The process must be mirrored on the partner domain controller using the exact same password, or completed in a single step if the administrator holds administrative credentials in both domains.
  4. TDO Storage: Both domain controllers record the relationship in their local Active Directory database as an explicit external trust. In this scenario, the trust attributes mark the connection as non-transitive.
  5. Authentication Handling: Unlike intra-forest tree trusts that leverage Kerberos transitive referral paths, cross-forest tree-root trusts in Windows 2000 fall back to NTLM authentication for pass-through authentication between the two specific domains. Child domains of either tree cannot use this trust path.