srl
Domain Trusts
A trust establishes forest or intra-forest domain (parent-child / tree-root) authentication, allowing users to access resources in — or perform administrative tasks in — another domain outside the one where their account resides. A trust creates a link between the authentication systems of two domains and may allow one-way or two-way (bidirectional) communication.
The single most important idea in 2026 is that the forest, not the domain, is the security boundary . Within a forest, SID filtering is off by default, which means control of one domain frequently means a path to the entire forest. Cross-forest, the boundary is real but not absolute — a weak SpoofSIDHistoryBlocked configuration or the trust key collapses it.