Active Directory 林信任是否具有传递性？
我正在对正在开发的应用程序进行故障排除，该应用程序在多林环境中使用来自 Active Directory 的信息，当前的问题是确定林信任是否具有传递性，如果是，则在什么条件下传递。
设置：使用 Active Directory 2003，ForestA 与 ForestB 建立双向林信任。 ForestB 与 ForestC 具有双向林信任。
在这种情况下，ForestA 和 ForestC 之间是否存在某种信任关系？ 我发现了一些相互矛盾的信息； 第一个链接清楚地表明林信任不可传递到其他林：
林信任只能在两个林之间创建，不能隐式扩展到第三个林。 这意味着，如果在林 1 和林 2 之间创建了林信任，并且在林 2 和林 3 之间也创建了林信任，则林 1 不会与林 3 产生隐式信任。
不过，我也可以在信任类型列表，表明林信任具有传递性：
信托类型：森林 传递性：传递
在通过“管理域和信任”查看时，在此林之上，信任在活动目录信任列表中显示为“传递”
这是否意味着林信任在信任林中具有传递性但不去其他森林？ 所以在前面提到的场景中：
ForestA <-> 森林B <-> ForestC
子域将通过传递性获取林信任（因此 subdom1.ForestA 将信任 office7.ForestB），但ForestB之间将共享访问权限strong>森林A和森林B。 这是正确的吗，还是我对微软发布的相当混乱的信息感到困惑？ 有没有人有这方面的个人经验可以分享？
I'm working on trouble shooting an application under development that uses information from Active Directory in a multi-forest environment and I have the current problem down to figuring out if forest trusts are transitive, and if so under what conditions.
The setup: Using Active Directory 2003, ForestA has a two-way forest trust with ForestB. ForestB has a two-way forest trust with ForestC.
In this situation is there any sort of trust relationship between ForestA and ForestC? I've found some conflicting informaion; this first link clearly indicates the forest trust in not transitive to other forests:
Forest trusts can only be created between two forests and cannot be implicitly extended to a third forest. This means that if a forest trust is created between forest 1 and forest 2, and a forest trust is also created between forest 2 and forest 3, forest 1 will not have an implicit trust with forest 3.
However, I can also find in the list of trust types an indication that forest trusts are transitive:
Trust type: Forest
Transitivity: Transitive
On top of this forest trusts show as "transitive" in the list of active directory trusts when viewed through "Manage domains and trusts"
Does this mean that the forest trust is transitive WITHIN the trusting forest but not to other forests? So in the previously mentioned scenario:
ForestA <-> ForestB <-> ForestC
Subdomains would pick up the forest trust through transitivity (so subdom1.ForestA would trust office7.ForestB) but there would be access shared between ForestA and ForestB. Is this correct, or have I become confused by the rather confusing information microsoft publishes? Does anyone have personal experience of this that they can share?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
具体来说，我认为微软的传递林信任中的“传递”是针对每个林内的域，而不是林到林到林。
例如，
森林 1 具有根域 A 和两个子域 B 和 C
具有根域 X 和两个子域 Y 和 Z 的林 2
具有传递林信任的域 Z 将自动信任域 C，无需创建直接信任链接（快捷信任）。
Specifically, I believe the "transitive" in Microsoft's Transitive Forest Trusts is for the domains within each forest rather than forest-to-forest-to-forest.
E.g.
Forest 1 with root domain A, and two child domains B and C
Forest 2 with root domain X, and two child domains Y and Z
With a transitive forest trust domain Z would trust domain C automatically, without needing to create a direct trust link (shortcut trust).
对三个域的测试表明来自林信任的信息是正确的； 当我在配置 ForestA <-> 中设置三个森林时 森林B<-> ForestC ForestA 无法看到来自 ForestC 的任何凭证。
Testing with three domains shows the information from forest trusts is correct; when I set up three forests in the configuration ForestA <-> ForestB <-> ForestC ForestA was not able to see any credentials from ForestC.
跨林信任不具有传递性。 父/子域/树信任是...
http: //technet.microsoft.com/en-us/library/cc773178(WS.10).aspx
Cross Forest Trusts are NOT transitive. Parent/Child Doman/tree trusts are...
http://technet.microsoft.com/en-us/library/cc773178(WS.10).aspx
NT 4 域信任不能以这种方式传递。 不确定AD。
NT 4 domain trust weren't transitive in this fashion. Not sure about AD.