Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Chapter 8. Trust

The concept of trust is an ancient one. On a personal level, it evokes relationships in which we give another person access to secrets, use of our belongings, even the very safety of our family and ourselves. The meaning of trust is often extended to nation-states when they write treaties or businesses when they form partnerships. Each agrees to some sort of goal sharing, perhaps resources and knowledge. The use of the term "trust" in describing relationships between computers and collections of computers on a network is sound, as long as we understand exactly what various kinds of "trust" mean.

In a Windows NT 4.0 and Windows 2000 network, trust relationships enable powerful interactivity between domains. Users in one domain can be given access to resources in another. It is no longer necessary to provide each user unique accounts in each domain. Consequently, users do not have to remember multiple account names and passwords just to access the resources they need to do their jobs. User identity can also be maintained across domain boundaries. No one needs to wonder if domain1\joe is the same individual as domain2\joe. Administration can also be shared. Users can obtain administrative privileges across domain boundaries. In a Windows Server 2003 network, these concepts are still applicable; however, additional benefits are available, and access across domain boundaries can be more tightly controlled.

A new type of trust, the forest trust, extends the trust concept. A forest trust can provide complete Kerberos-style trust between all domains in two forests.

A new type of control, selective authentication, empowers administrators of a forest trust to more closely restrict access of users from the trusted forest to only some of the domains within their forest.

The control offered by selective authentication empowers administrators of an external trust to limit the access of a trusted domain's users to only some of the servers in their own domain.

The purpose of a trust is not to remove all boundaries between forests. The purpose of a trust is to allow some activity across forest boundaries to permit activity that might not otherwise occur due to forest boundaries. (For example, providing users in one forest access to resources such as files in another forest is a typical reason for a trust.) This chapter will do the following:

Define and explore the many types of trust in a Windows Server 2003 network and explain the ways in which they may best be used.

Explore the new issues trust relationships bring or benefit from, such as group scope, choosing the direction of trust, penetrating security boundaries, SID-history transitivity, and forest functional level.

Explain trust relationships in the single forest.

Discuss forest functional level.

Explain cross-forest trust relationships.

Discuss Group Policy Issues and the use of Group Policy Management Tools in multidomain and multiforest management.