Workshop

A Matter of Trust
Previous Table of Contents Next
Because NT domains aren’t really a directory service, there must be some way for a user on one NT
domain to use the resources of another NT domain. The mechanism that allows users of one domain to
use resources of another is called trust. Trust relationships can be a one- or two-way relationship.
Say your boss gives you access to the file cabinet with everybody’s salaries. He has placed trust in you
that you’ll not blab everybody’s salaries all over town. Similarly, you trust your boss to pay you on
Friday. This is a two-way trust relationship. On the other hand, your small children must trust you to put
food on the table. You do not trust the older child at the tender age of 6 years old to stay with his 2-yearold
brother; his idea of fun would be to feed his dinner to the dog and to feed the dog food to his brother.
This, of course, is a one-way trust relationship.
You make NT domain trust decisions in a similar fashion. If you need for folks in domain A to be able to
access resources in domain B, but not vice versa, you establish a trust relationship between domains B
and A. You would say that A was trusted by B, and that B trusts A.
If one person in one of your NT domains (domain B) cannot access a resource (a share or a printer) in
another one of your NT domains (domain A), you probably want to check the trust relationship. Make
sure that the domain providing the resource is trusting, and that the domain that needs the resource is
trusted. Take the following steps:
1. Go to the NT server of the domain with the resources (domain A).
2. From the Start menu, select Programs|Administrative Tools|User Manager for Domains.
3. From the Policies menu in the User Manager, select Trust Relationships.
4. Make sure the other domain (domain B) is listed as trusted.
5. Go to the NT server of the trusted domain.
6. Start the User Manager and check the trust relationships again.
7. Make sure the first domain (domain A) is listed as trusting.
I’ve been in a shop where we needed to establish a two-way trust relationship between two domains via a
wide-area link. Even though we established the trust relationship properly, it seemed to fail. The system
administrator got the following message when he attempted to administer the remote domain:
There are no logon servers available to service the logon request
The key was in the fact that these were wide-area linked domains, and they relied on TCP/IP as a