Verifying and resetting a trust

After you create a trust, you might regularly want to check if the trust is working properly. You might be triggered by people who report that they can no longer access resources in other domains or forests, or it might be an activity that you perform on a regular basis.

When a trust is broken, there is a way to reset it. Also, when you want to reset the shared secret on both sides of the trust, a reset of the trust is needed.

Getting ready

It is recommended that you sign in to the domain controller that is running the Domain Naming Master FSMO role, or connect the Active Directory Domains and Trusts console to this specific domain controller, by right-clicking in the console on the Active Directory Domains and Trusts node and selecting Change Active Directory Domain Controller… from the context menu.

To find this domain controller, right-click the Active Directory Domains and Trusts node and select the Operations Master… from the context menu, or run the following command from any domain-joined device, member server, or domain controller:

netdom.exe query fsmo

Alternatively, use the following PowerShell commands on a domain-joined system that has the Active Directory module for Windows PowerShell installed:

Import-Module ActiveDirectory

Get-ADForest | Format-List DomainNamingMaster

Required permissions

For shortcut trusts, sign in with the credentials of an account that is a member of the Domain Admins group.

For all other accounts, sign in with the credentials of an account that is a member of the Enterprise Admins group.

How to do it...

Perform these steps:

1. Open Active Directory Domains and Trusts.
2. In the console tree, right-click the domain that you want to allow access to, and then click Properties.
3. Navigate to the Trusts tab.
4. From the list of Domains trusts by this domain (outgoing trusts):, or from the list of Domains that trust this domain (incoming trusts):, select the trust you want to verify.

5. Click the Properties button next to the corresponding list.
   The Properties window appears:

6. Click the Validate button.
7. For a two-way trust, choose between No, do not validate the incoming trust and Yes, validate the incoming trust. For the latter, provide the credentials of an account that has administrative privileges in the Active Directory domain on the other side of the trust. Click OK.

8. In the Active Directory Domain Services popup window, click OK to confirm that the outgoing trust has been validated. It is now in place and active.
9. In the Active Directory Domain Services popup window, notifying you of UserPrincipalName suffix routing, click Yes.

Alternatively, you can use the following command:

netdom.exe trust TrustingDomain.tld /Domain:TrustedDomain.tld /TwoWay /Verify /verbose

Replace TrustingDomain.tld with the DNS domain name of the Active Directory environment that gives access to its resources, and then replace TrustedDomain.tld with the DNS domain name of the Active Directory environment that gains access to the resources.

In the preceding example, a two-way trust is created where both Active Directory environments give and gain access to the other Active Directory environment.

The option to reset the trust will be presented only if a problem has been identified during the process of verifying the trust relationship.

How it works...

When a trust is verified, the following characteristics of the trust are verified:

• Networking connectivity between both sides of the trust
• Existence of the trust on the far side of the trust
• Synchronization of the shared secret on both sides of the trust

Therefore, verifying a trust is a good point to start troubleshooting, because it might quickly be able to identify changes made by network admins or the Active Directory admin on the other side of the trust.

When a trust relationship cannot be verified, the option to reset it is displayed, as indicated previously.