Active Directory Trust Relationships Brief
What It Is
Active Directory recognizes five named trust types: parent-child, tree-root, cross-link, external, and forest. A diagram or enumeration tool draws every trust the same way, a line between two domain names, but the type tells you who created it, whether it was automatic or a deliberate decision, and what its default properties are before anyone touches a configuration flag. Each type answers two questions differently: is it created automatically as a side effect of forest structure, or configured on purpose? And does it connect two individual domains, or operate at the level of the entire forest?
The Five Trust Types
- Parent-child: automatic, structural; connects a domain to its immediate parent in the same tree the moment the child domain is created
- Tree-root: automatic, structural; connects the forest root to the root of a newly added tree that has its own, unrelated namespace
- Cross-link (shortcut): deliberate; a direct trust between two domains that are not parent-child, added to shorten an authentication path that would otherwise route through a common ancestor
- External: deliberate, non-transitive, SID-filtered by default; connects one specific domain to one specific domain in a different, untrusted forest
- Forest: deliberate; connects two forest roots and, by default, extends transitively to every domain in both forests, the only type that operates at the forest level
A Family Tree With A Twist
Some relationships are automatic because of birth order, and some are relationships people chose to form later in life. A parent-child trust is the direct line between a domain and its own parent, formed the instant the child exists. A tree-root trust is an adoption at the top level: a differently-named tree's root joins the forest and is treated as immediate family. A cross-link trust is a shortcut added between cousins several branches apart, so authentication does not have to travel up to a common ancestor and back down. An external trust is a handshake with one specific outsider, with nothing implied about the rest of either organization. A forest trust is a treaty negotiated once, at the top, between two forest roots, and by default extended to cover every domain in both families.
Interview Phrasing
Active Directory has five named trust types. Parent-child and tree-root trusts are created automatically as a byproduct of how the forest is built: parent-child connects a domain to its immediate parent in the same tree, tree-root connects a differently-named tree's root to the forest root. Neither requires a deliberate configuration decision. Cross-link, external, and forest trusts are all created deliberately by an administrator. A cross-link is a shortcut directly between two domains that would otherwise route through a common ancestor. An external trust connects one specific domain to one specific domain in a different forest. A forest trust connects two forest roots and, by default, extends to every domain in both forests. Knowing which type you are looking at tells you the default properties before you check anything: structural trusts default to transitive with no SID filtering, deliberate cross-forest trusts default to SID-filtered. That is why I always name the type specifically when I report a trust relationship, not just describe that a line exists.
Common Pitfalls
- Treating tree-root and parent-child as the same thing: both are automatic, but a parent-child trust links a domain to its immediate parent while a tree-root trust links a whole new, differently-named tree to the forest root
- Assuming cross-link trusts are common: they are not automatic, and most forests never have one; finding one means someone made a deliberate performance decision worth asking about
- Conflating external trust with forest trust: an external trust is scoped to exactly one domain on each side, a forest trust is scoped to the entire forest by default
- Assuming every inter-forest connection is a forest trust: two organizations can be connected by a single external trust between two specific domains with no forest-level relationship existing at all
Practice Prompts
- Explain the practical difference between a tree-root trust and a parent-child trust, and why the distinction matters when you describe a forest's shape
- Explain why an administrator would add a cross-link trust instead of leaving authentication to route through the forest root
- Explain what finding an external trust during an assessment tells you that a forest trust would not
- Explain to a client the difference in exposure between 'a forest trust to our acquisition' and 'an external trust to one of their domains'
- Explain why parent-child and tree-root trusts are considered structural rather than deliberate, and what that implies about how often you should expect to see them
