FFoundationalActive Directory
Active Directory Trust Relationships
Every AD trust looks the same in a diagram: a line between two domains. But that line can mean five different things, each with a different origin and a different default risk profile. This lesson gives you the naming map so you can identify exactly what kind of trust you are looking at.
This lesson builds on
Why it matters
A trust diagram or enumeration tool draws every relationship the same way: a line connecting two domain names, maybe with an arrowhead. But that line can represent five structurally different relationships, and the type of trust tells you things the arrow alone does not: who created it, whether it was automatic or a deliberate decision, and what its default properties are before anyone touches a configuration flag.
Telling a stakeholder "there's a trust between these two domains" without naming which kind describes the picture but not the mechanism. Naming the trust type correctly is what separates a vague observation from a precise one, and precision is what a technical audience is listening for.
Key Concepts
- Parent-child trust — the two-way transitive trust automatically created when a new child domain is added beneath an existing domain in the same tree; the most common trust in any multi-domain forest
- Tree-root trust — the two-way transitive trust automatically created between the forest root domain and the root of a newly added tree; connects a tree with a different namespace into the forest without making it a child of anything
- Cross-link (shortcut) trust — a two-way trust manually created directly between two domains that are not in a parent-child relationship, added to shorten the authentication path instead of routing through the forest root
- External trust — a non-transitive trust created manually between one specific domain and another domain in a different, untrusted forest; SID-filtered by default and does not extend to any other domain in either forest
- Forest trust — a trust created manually between two forest root domains that, by default, extends transitively to every domain in both forests; the only trust type that operates at the forest level rather than the domain level
Theory
Core idea
Active Directory recognizes five named trust types: parent-child, tree-root, cross-link, external, and forest. Each one answers two questions differently: is it created automatically as a side effect of how the domain or forest is built, or does an administrator have to configure it on purpose? And does it connect two individual domains, or does it operate at the level of the entire forest?
Parent-child and tree-root trusts are structural: they exist because of how the forest itself is assembled. Adding a child domain creates the parent-child trust automatically. Grafting a new tree onto the forest creates the tree-root trust automatically. Neither requires a deliberate configuration decision.
Cross-link, external, and forest trusts are deliberate. Nobody gets one by accident. An administrator adds a cross-link to speed up authentication between two domains that would otherwise route through the root, and establishes an external or forest trust to connect to an organization, acquisition, or partner outside the current forest. Knowing which category a trust falls into tells you immediately whether you are looking at forest architecture or a specific business decision someone made.
Mental model
Picture the forest as a family tree with a twist: some relationships are automatic because of birth order, and some are relationships people chose to form later in life.
A parent-child trust is the direct line between a domain and the domain immediately above it in the same tree, the equivalent of a parent and their own child. It exists the moment the child domain is created; nobody has to decide to form it.
A tree-root trust is different: it connects the forest root to the root of a second tree with its own, unrelated namespace, brought into the same forest. It is an adoption at the top level: the new tree's root is not descended from the forest root, but the forest treats it as immediate family once it joins.
A cross-link trust is a shortcut between two domains that are otherwise cousins several branches apart. Without it, authentication between them travels up to a common ancestor and back down. A cross-link is a direct line added between the cousins so it does not have to make that trip, an optimization rather than a structural necessity, which is why most forests never have one.
An external trust is a handshake with someone entirely outside the family tree: one specific domain, in one specific outside forest, with nothing implied about anyone else in either organization.
A forest trust is the closest thing to a treaty between two whole families: negotiated once, at the top, between the two forest roots, and by default extended to cover every domain in both forests, not just the two roots that signed it.
The domain-trusts lesson gave you the properties that describe any of these relationships once you have identified it: direction, transitivity, and SID filtering. This lesson is about identifying which of the five shapes you are looking at before you reason about those properties.
Common misunderstandings
- Treating tree-root and parent-child as the same thing. Both are automatic and both connect a domain to the forest, but they connect different things. A parent-child trust links a domain to its immediate parent in the same namespace. A tree-root trust links a whole new, differently-named tree to the forest root. If someone says "child domain" about a tree-root relationship, they are describing the wrong topology.
- Assuming cross-link trusts are common. They are not automatic, and most forests never have one. A cross-link only appears when an administrator deliberately shortens a long authentication path in a large, deep forest. If you see one during an assessment, it tells you something specific: someone made a performance decision, and it is worth asking who and why.
- Conflating external trust with forest trust. Both cross a forest boundary, but an external trust is scoped to exactly one domain on each side. A forest trust is scoped to the entire forest by default. Calling a forest trust "an external trust to their whole company" understates what it grants, and calling an external trust a "forest trust" overstates it.
- Assuming every inter-forest connection is a forest trust. Two organizations can be connected by an external trust between two specific domains without any forest-level relationship existing at all. The two forests remain otherwise unrelated. Naming the trust type correctly prevents you from assuming access exists somewhere it does not.
Real-world context
In practice, the trust types you encounter most often are parent-child and, less frequently, forest trusts formed after a merger or acquisition. Tree-root and cross-link trusts show up in larger, more deliberately engineered environments: a company running multiple business units under separate namespaces within one forest, or a deep domain hierarchy where an administrator added a shortcut for performance. External trusts tend to appear as narrower, more surgical connections: one team needing access to one domain in another organization, without either side wanting to open the whole forest.
When you enumerate trusts during an assessment, naming the type is part of the finding, not a footnote. "There is a trust to a partner organization" is incomplete. "This is a forest trust, which by default extends to every domain on both sides" or "this is an external trust, scoped to exactly this one domain" gives a client something to act on: a forest trust warrants a conversation with the partner's whole security team, while an external trust might only need a review of one account's access.
Recognizing the type also saves time before you check anything else. A parent-child or tree-root trust tells you, by default, to expect two-way, transitive access and no SID filtering, before you have looked at a single flag. An external or forest trust tells you to expect non-transitive access and SID filtering enabled. The type is a shortcut to the defaults; you still verify, but you know what you are verifying against.
Communication
Interview answer
Active Directory has five named trust types. Parent-child and tree-root trusts are created automatically as a byproduct of how the forest is built: parent-child connects a domain to its immediate parent in the same tree, tree-root connects a differently-named tree's root to the forest root. Neither requires a deliberate configuration decision.
Cross-link, external, and forest trusts are all created deliberately by an administrator. A cross-link is a shortcut directly between two domains that would otherwise route through a common ancestor. An external trust connects one specific domain to one specific domain in a different forest. A forest trust connects two forest roots and, by default, extends to every domain in both forests.
Knowing which type you are looking at tells you the default properties before you check anything: structural trusts default to transitive with no SID filtering, deliberate cross-forest trusts default to SID-filtered. That is why I always name the type specifically when I report a trust relationship, not just describe that a line exists.
Follow-up questions
- What is the practical difference between a tree-root trust and a parent-child trust, and why does the distinction matter when you describe a forest's shape?
- Why would an administrator add a cross-link trust instead of leaving authentication to route through the forest root?
- If you find an external trust during an assessment, what does that tell you that a forest trust would not?
- How would you explain to a client the difference in exposure between "a forest trust to our acquisition" and "an external trust to one of their domains"?
- Why are parent-child and tree-root trusts considered structural rather than deliberate, and what does that imply about how often you should expect to see them?
