๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ฒ ๐๐ถ๐๐ ๐ก
๐ข๐ป๐ฒ-๐๐ฎ๐ ๐๐ ๐๐ฟ๐๐๐? ๐๐ผ๐ปโ๐ ๐ฎ๐๐๐๐บ๐ฒ ๐๐ต๐ฒ ๐ฟ๐ถ๐๐ธ ๐ผ๐ป๐น๐ ๐ด๐ผ๐ฒ๐ ๐ผ๐ป๐ฒ ๐๐ฎ๐.
This is one of those Active Directory behaviors I think deserves much more attention. With a ๐ผ๐ป๐ฒ-๐๐ฎ๐ forest or external trust, we naturally think about the direction of the trust:
โก๏ธ Forest A trusts Forest B โ users from B can access permitted resources in A.
But there is another part of the equation – theย ๐๐ฟ๐๐๐ ๐ฎ๐ฐ๐ฐ๐ผ๐๐ป๐ย created in the trusted domain. โ ๏ธ If the trusting forest is compromised, an attacker who obtains the trust secrets ๐ฐ๐ฎ๐ป ๐ฎ๐๐๐ต๐ฒ๐ป๐๐ถ๐ฐ๐ฎ๐๐ฒ as that trust account against theย trusted forest.
And because that account is still an authenticated identity in the trusted domain, this ๐ฐ๐ฎ๐ป ๐ฝ๐ฟ๐ผ๐๐ถ๐ฑ๐ฒ ๐ผ๐ฝ๐ฝ๐ผ๐ฟ๐๐๐ป๐ถ๐๐ถ๐ฒ๐ forย reconnaissance, lateral movement, or further privilege escalation depending on the environment.
๐ช๐ถ๐ป๐ฑ๐ผ๐๐ ๐ฆ๐ฒ๐ฟ๐๐ฒ๐ฟ ๐ฎ๐ฌ๐ฎ๐ฑ ๐ฐ๐ต๐ฎ๐ป๐ด๐ฒ๐ฑ ๐๐ผ๐บ๐ฒ๐๐ต๐ถ๐ป๐ด ๐ต๐ฒ๐ฟ๐ฒ. Microsoft introduced two new groups:
๐นย Forest Trust Accountsย with RID 528
๐นย External Trust Accountsย with RID 529
Trust accounts are moved away from the traditionalย Domain Usersย primary group into these dedicated groups. That is a useful hardening change because resources granted toย Domain Usersย are no longer automatically accessible by those trust accounts.
๐๐๐ ๐ฑ๐ผ๐ฒ๐ ๐ถ๐ ๐ณ๐ถ๐ ๐๐ต๐ฒ ๐ฟ๐ฒ๐ฎ๐น ๐ฝ๐ฟ๐ผ๐ฏ๐น๐ฒ๐บ?
โก๏ธ Unfortunately,ย no.
Jorge de Almeida Pinto recently tested this with Windows Server 2025 DCs and demonstrated that the trust account ๐ฐ๐ผ๐๐น๐ฑ ๐๐๐ถ๐น๐น ๐ผ๐ฏ๐๐ฎ๐ถ๐ป a TGT using the trustโs AES keys. Windows Server 2025 moves trust accounts into dedicated groups, but they are still part of ๐๐๐๐ต๐ฒ๐ป๐๐ถ๐ฐ๐ฎ๐๐ฒ๐ฑ ๐จ๐๐ฒ๐ฟ๐ after authentication.
โ This is exactly why I still treat one-way trusts as a potential path in both directions, not as a simple one-way security boundary.
๐ ๐๐๐น๐น ๐ฐ๐ฟ๐ฒ๐ฑ๐ถ๐ to Jorge de Almeida Pinto for the research and testing. I highly recommend reading the full article.
https://jorgequestforknowledge.wordpress.com/category/active-directory-domain-services-adds/trusts/
