How to establish trust between two Active Directory forests and provide cross-domain file access
Cross-domain file access requires routed connectivity, conditional DNS forwarding, time synchronisation, validated trust, cross-domain groups, share permissions, and NTFS ACLs.
Cross-domain file access requires routed connectivity, conditional DNS forwarding, time synchronisation, validated trust, cross-domain groups, share permissions, and NTFS ACLs. For this case, first verify bidirectional DNS conditional forwarding and inter-domain time synchronization, then use trust direction and validation to decide whether remediation is needed.
Define the failure boundary first
For this file access and permissions case, establish the failure boundary with DNS and inter-domain time synchronization, then continue to trust direction and validation. Capture the current state, incident time and one known-good comparison before changing production configuration.
Work through the dependency chain
| Check | Why it matters | Recommended action |
|---|---|---|
| 01 · bidirectional DNS conditional forwarding | Verify bidirectional DNS conditional forwarding on the affected path using logs, counters or state information rather than relying only on the configured rule. | Record the current value, evidence source and timestamp for bidirectional DNS conditional forwarding. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 02 · inter-domain time synchronization | Verify inter-domain time synchronization on the affected path using logs, counters or state information rather than relying only on the configured rule. | Check inter-domain time synchronization read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 03 · trust direction and validation | Verify trust direction and validation on the affected path using logs, counters or state information rather than relying only on the configured rule. | Compare trust direction and validation with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
| 04 · cross-domain security-group strategy | Review the current state, related logs and recent changes for cross-domain security-group strategy, then align them with the incident timeline before deciding whether a change is required. | Record the current value, evidence source and timestamp for cross-domain security-group strategy. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 05 · effective share/NTFS permissions | Review the current state, related logs and recent changes for effective share/NTFS permissions, then align them with the incident timeline before deciding whether a change is required. | Check effective share/NTFS permissions read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 06 · SPN/Kerberos and firewall ports | Review the current state, related logs and recent changes for SPN/Kerberos and firewall ports, then align them with the incident timeline before deciding whether a change is required. | Compare SPN/Kerberos and firewall ports with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
Change only after the evidence is clear
- Start with read-only evidence. Check bidirectional DNS conditional forwarding and inter-domain time synchronization before changing configuration.
- If the first checks are normal, continue with trust direction and validation and cross-domain security-group strategy, keeping evidence tied to the incident time.
- Change configuration only when the evidence explains the symptom. For effective share/NTFS permissions, preserve the original value and define the rollback trigger before adjustment.
- Validate SPN/Kerberos and firewall ports in a controlled scope before expanding to production users or traffic.
Validation and rollback
- Validate the complete user or application workflow; do not stop at the single status of bidirectional DNS conditional forwarding.
- Recheck effective share/NTFS permissions and SPN/Kerberos and firewall ports after the change and confirm that no new bypass, permission expansion or secondary error has appeared.
- Archive evidence from bidirectional DNS conditional forwarding through SPN/Kerberos and firewall ports, together with before/after configuration, business validation and the rollback point.
Common wrong turns
- Changing DNS and inter-domain time synchronization at the same time, which makes the original cause impossible to prove.
- Treating a normal result for trust direction and validation as proof that cross-domain security-group strategy and the rest of the business path are healthy.
- Leaving a temporary exception related to effective share/NTFS permissions or SPN/Kerberos in production without an owner, expiry time and rollback note.
Related questions
Where should I start with “How to establish trust between two Active Directory forests and provide cross-domain file access”?
Start with bidirectional DNS conditional forwarding and inter-domain time synchronization; they establish the first useful troubleshooting boundary without changing production state.
What should be checked after the first layer looks normal?
Continue with trust direction and validation and cross-domain security-group strategy, then correlate the result with the incident time and the actual user or application path.
What should be retained after the change?
Keep evidence for effective share/NTFS permissions and SPN/Kerberos and firewall ports, plus the original configuration, validation result, observation notes and rollback point.