authenticationactive-directorytrust

Active Directory: Allow users of different domain to login


We currently have all of our servers in domain A.

But many users from a different department also need to log in on our systems, however, their devices are registered in domain B.

What kind of trust should I set up to allow the users of domain B to log in on our server in domain A.

I assume a one way trust is sufficient to be able to add domain B users to our domain A user groups in the Active Directory? But what direction should it be?

Does that mean that I will be adding the users like domainB\user1 to domainA\group1. Or do I have to redefine domainB\user1 in domain A as domainA\user1 (with the same username and password) and then add domainA\user1 to domainA\group1?


Solution

  • Yes, a one-way trust will likely do. A one-way trust essentially means "Domain A trusts that Domain B users are who they say they are".

    So if Domain A trusts Domain B, then you will be able to add Domain B users to Domain A groups.

    The opposite will not be true, unless you make a two-way trust.