Identifying types of trusts

You’ll work with four types of trusts in Windows Server 2022. Each has its pros and cons and different use cases:

• Shortcut trust: Shortcut trusts are used on Windows Server domains that reside in the same forest, where there is a need to optimize the authentication process. This may happen when a user on Domain A frequently needs to authenticate to Domain B. They’re transitive and they can be created as one-way or two-way trusts.
• Realm trust: A realm trust allows you to create a trust between a Windows Server domain and a non-Windows (think Linux, Unix, or MacOS Server) Kerberos realm. Realm trusts have a lot of flexibility; they can be transitive or nontransitive and created as one-way or two-way trusts.
• External trust: External trusts connect a Windows Server domain in one forest to another Windows Server domain in a different forest. External trusts are nontransitive and can be established as one-way or two-way trusts.
• Forest trust: Forest trusts create a trust relationship between two Windows Server forests. They’re transitive and can be established as one-way or two-way trusts.

Creating a domain trust

Creating a domain trust is pretty simple. Let’s look at a use case and build it out.

Let’s say you have your domain in its own forest, and you want to connect to another Windows domain in another forest. You know that you need to set up an external trust, given the types of trusts you can create. Here are the steps to set that up:

1. From Server Manager, choose Tools⇒  Active Directory Domains and Trusts.
2. Right-click your domain name and select Properties.
3. Click the Trusts tab, and then click the New Trust button.
4. On the Welcome to the New Trust Wizard screen, click Next.

5. On the Trust Name screen, type the name of the domain you want to establish the trust relationship with.

   In my case, it’s someotherorg.com, see Figure 4-1.

6. Click Next.

   

7. On the Trust Type screen, assuming that you’re creating a trust between the root domains of each forest, select External Trust (as shown in Figure 4-2), and click Next.

   

8. On the Direction of Trust screen, you can set whether you want the trust to be two-way or one-way; in this case, select Two-Way (shown in Figure 4-3), and click Next.

   

9. On the Sides of Trust screen, you need to set whether you’re setting the trust on your domain or on both domains; for this example, select Both This Domain and the Specified Domain (as shown in Figure 4-4).

   

10. Click Next.

    You may be wondering why you would need to specify your local domain or both domains after you said you wanted to create a two-way trust. If you have the credentials for both domains (via universal or domain local security groups), then you can choose to create the trust in both. Say you recently acquired a business partner but you don’t know the credentials for a domain admin or enterprise admin account. You’d have to choose This Domain Only, and then one of their admins would need to repeat the process on their side to establish a two-way trust.

11. On the next screen, enter the username and password of a domain administrator or enterprise administrator account, and click Next.
12. On the Outgoing Trust Authentication-Local Domain screen, choose Domain-Wide Authentication, and click Next.
13. On the Outgoing Trust Authentication-Specified Domain screen, choose Domain-Wide Authentication, and click Next.
14. On the Trust Selections Complete screen, click Next.
15. On the Trust Creation Complete screen, click Next.
16. On the Confirm Outgoing Trust screen, select Yes, confirm the outgoing trust, and click Next.

17. On the Confirm Incoming Trust screen, click Yes, confirm the incoming trust, and click Next.

    If all goes well, you see the Completing the New Trust Wizard screen, shown in Figure 4-5.

18. Click Finish.

Understanding what an Active Directory site is

A site in Active Directory is a representation of a physical site. Each site gets associated with an Active Directory domain. Although domains can contain many sites, a site can’t be joined to more than one domain.

Sites are useful with geographically distant locations as they can tell clients that are connecting which domain controller is the closest. This minimizes the amount of traffic that needs to flow over the network and can also improve performance since Active Directory replication is able to occur with the closest domain controller.

Creating a site

Now that you know what a site is, you probably want to create your own. Here’s how to create a site in Active Directory Sites and Services:

1. With Server Manager open, choose Tools⇒  Active Directory Sites and Services.
2. Right-click Sites and choose New Site.

3. Fill in the name of the site and select a site link object.

   In this case, choose the default, as shown in Figure 4-6.

4. Click OK.

Of course, a site is not useful without a subnet assigned to it, so let’s do that next:

1. Right-click Subnets and choose New Subnet.

2. Enter the prefix for the site.

   For my example, I’ve entered 192.168.178.0/24.

3. Select the site you just created (in my case, Demo).

   Your screen should look similar to Figure 4-7 at this point.

4. Click OK.

That’s all there is to it. You’ve created your first site in Active Directory!

Creating users

Creating users is arguably the most common task a system administrator will do in relation to Active Directory. Thankfully, Microsoft has made the process pretty painless:

1. From Server Manager, choose Tools⇒  Active Directory Users and Computers.

2. Right-click the OU or container that you want to create the user account in.

   For this example, I use the default Users container.

3. Select New and then User.
4. Fill in the First Name and Last Name (Full Name will automatically populate with what you use), and select a logon name (in my case, ksmith, as shown in Figure 4-8).
5. Click Next.

   

6. Type a password for the user and then type it again in the Confirm Password field.
7. In most cases, you’ll select User Must Change Password at Next Logon.
8. Click Next.
9. On the confirmation screen, click Finish.

Now if you look in the Users container, you see your new user account. You can reset the password on the account by right-clicking the user’s name and choosing Reset Password. You can disable the account by right-clicking the user’s name and choosing Disable Account. Finally, you can configure the more advanced options for the user account by right-clicking the user’s name and choosing Properties. This gives you a multitude of selections, like setting organizational information, setting group memberships, and other pertinent information (see Figure 4-9).

Creating groups

Having a domain user account is great because it gives your users the ability to log in to multiple systems or applications with the same account. Giving each user account direct access to resources quickly becomes a nightmare, however, because it’s very difficult to keep up. When a user leaves, for example, you have to remove them from every location they had access to. If you use a domain group instead, you can still ensure they get the access they need, but when they leave the organization, you can simply remove them from the group and disable their account.

1. From Server Manager, choose Tools⇒  Active Directory Users and Computers.

   

2. Right-click the OU or container that you want to create the user account in.

   For this example, I’ll use the default Users container.

3. Select New and then Group.

4. Fill in the Group Name field.

   I simply entered New Group.

5. Choose the Group Scope.

   Your options are as follows:

   • Domain local: Groups that are only visible within their own domain.
   • Global: Visible forest-wide but can only contain accounts and groups from the same domain.
   • Universal: Visible forest-wide and can contain accounts and groups from across the forest.

   For this example, I chose Domain Local.

6. Choose the Group Type.

   Your options are as follows:

   • Security: Used to manage user or computer access to resources on the network.
   • Distribution: Used for email lists; can’t be used to assign permissions to objects.

   In this case, I chose Security, shown in Figure 4-10.

7. Click OK.

Groups don’t really do much without users, so let’s assign the new user account you created to the new group that you just created:

1. Double-click your new group.
2. Click the Members tab.

3. Click Add, and type the name of the user and click OK.

   In my case, this is Karen Smith.

4. Click OK to close the dialog box.

Enabling Active Directory Recycle Bin

Before the Active Directory Recycle Bin was introduced, there was no nice way to restore a user or a group after it was deleted. You could do a restore from a backup of Active Directory (no small feat), or you could re-create the object you deleted. Restoring Active Directory entailed stopping AD DS, restoring from a system state backup that was taken before the object was deleted, marking the objects as authoritative with the ntdsutil.exe utility, and then restarting AD DS.

ntdsutil.exe is a command line tool that allows you to work with Active Directory at a database level.

Microsoft realized that this was a pain point for Active Directory administrators everywhere, so it introduced the Active Directory Recycle Bin. But it isn’t enabled by default, so you must plan ahead and enable it. After it’s enabled, you can restore deleted items to Active Directory with no downtime. Deleted items aren’t kept forever; by default, they’re retained for 180 days. A system administrator can adjust this value if desired.

To enable Active Directory Recycle Bin, follow these steps:

1. From Server Manager, choose Tools⇒  Active Directory Administrative Center.
2. Select your domain from the left menu.

3. Click Enable Recycle Bin from the menu on the right, as shown in Figure 4-11.

   You see a dialog box warning you that Recycle Bin can’t be disabled after it’s enabled.

4. Click OK.

   You see a dialog box telling you to refresh Active Directory Administrative Center.

5. Click OK.

6. Click the circle with the two arrows inside of it at the top of the screen to refresh.

   Enable Recycle Bin is now grayed out.

Managing users and groups

Managing users and groups within Active Directory Administrative Center is not difficult. Most of the options become available when you select your domain name after you’ve opened Active Directory Administrative Center. For instance, if you right-click the Users container, you have the option to select New, and then User or Group. If you select User, you find that the user creation screen has a lot more options to work with. Figure 4-12 shows an example of user creation in Active Directory Administrative Center.

Being able to customize all these settings when creating a user is really nice. In the past, when using Active Directory Administrative Center, for example, you had to create the user. When the user was created, you could go into the User Properties screen and make the changes to the organizational tabs. Active Directory Administrative Center’s user creation utility lets you make all these settings all at once.