How to create a two-way Active Directory Trust

In this guide, we shall discuss how to create a two-way Active Directory Trust. A two-way trust will be created between these domains. This means that the two domains will be able to share their resources with each other. Please, see [AZURE] MSSQL Creating a new Azure SQL Database (PaaS), [AZURE] Restore MSSQL Server on Azure Virtual Machines Using Azure Backup, and MSSQL Server Error 833: A Synthesis of Real-World Case Studies.

Active Directory Trust Port Prerequisites

Network connectivity must be ensured between the domain controllers of all involved domains. In addition, servers and other resources in the Resource domain must be able to communicate with the domain controllers in the Accounts domain.

DNS name resolution must be configured so that domain controllers in each domain can resolve DNS records for the other domain’s Active Directory environment.

• An account that is a member of the Domain Admins group is required in each domain to create and complete a two-way trust.
• Alternatively, an account that is a member of Enterprise Admins (if the domains are in the same forest) has the necessary privileges across all domains in the forest.
• If the domains belong to different forests, credentials with Domain Admin privileges are still required in both forests to create and confirm the trust on each side.

Relevant operational notes:

• A two-way trust requires the creation and confirmation of the trust on both domains.
• Standard user accounts (Domain Users) are not sufficient.
• Custom delegation is theoretically possible. But not recommended and is rarely used in production environments due to increased complexity and operational risk.

In conclusion, the minimum and recommended requirement is Domain Admin privileges on both domains (or Enterprise Admin where applicable).

To begin, we should configure the DNS to allow each respective domain to resolve the other.

Please, see Pull and Push Commvault Images to Azure Container Registry, [AZURE] Security Service Edge (SSE) and Microsoft Entra ID, and how to Install SQL Server Always On & Configure Veeam Plug‑in for SQL.

Create DNS Conditional forwarders

To do this, we need to create a conditional forwarding server so that contoso.local can resolve dogcorp.local and vice versa. Now we will configure fabrikam.local.

Create DNS Conditional forwarder on contoso.local Domain

Verify DNS connectivity

Check dns resolution

Perform the same configuration on the fabrikam.local domain by creating the DNS conditional forwarder for the contoso.local domain.

Please, see “The security database on the server does not have a computer account for this workstation trust relation [Part 1]“, Active Directory Forest – Trees and Domain and Sites, and “There was an error opening the Trusted Platform Module snap-in: You do not have permission to open the Trusted Platform Module Console“.

Two-Way trust creation

Please, follow the steps below to create a two way trust.

Select “Forest trust”

Please, select “Two-way”

Here, select “Both this domain and the specified domain”

Use a dedicated domain account for both forests

Select “Forest-wide authentication”

Trust selections complete

This domain: contoso.local 
Specified domain: fabikam.local
Direction:
Two-way: Users in the local domain can authenticate in the specified domain and users in the specified domain can authenticate in the local domain.
Trust type: Forest trust
Transitive: Yes
Outgoing trust authentication level: Forest-wide authentication in local and specified forests.
Sides of trust: Create the trust for both this domain and the specified domain.

If the trust wizard fails, the DNS conditional forwarder for the source domain (contosol.local) has probably not been created in the target domain (fabrikam.local)

Once the wizard has been successfully completed, you can perform a check.

Validate Domains trusted by this domain (Outgoing trusts)

Click to validate

Click Yes

Validate Domains trusted by this domain (Incoming trusts)

Validate

Click on Yes to proceed

Recap trust

Please, see “Enter connection information for your on-premise directory or forests: Azure AD connect unable to connect directory, forest not available, and how to Specify user account name when adding a DC to an existing Forest“.

Trust verification via ADUC from both forests

Change domain

Selecet contoso.local

If you can access the forest browser, the trust is working correctly.

I hope you found this guide on how to create a two-way Active Directory Trust very useful. Please, feel free to leave a comment below.