Can group policies apply, in one way trust between the ABC.com domain and XYZ.com domain two forests

Question

Hi Tea,

Can group policies applied, in one way trust between the ABC.com domain and XYZ.com domain two forests.

We have two forest domain, one is ABC.com and another is XYZ.com, and there is one way trust configured from ABC.com to XYZ.com.

If we have applied any GP in ABC.com, will it be replicated to XYZ.com and it should not happen the other way round.

Answer 1

Hi,
If the condition is that there is a one way forest trust:form ABC.com (trusting) to XYZ.com (trusted) .
Based on my experience: when users from XYZ.com logon to workstation in domain ABC.com, the user policies deployed from XYZ can be also applied with one condition :the policy Allow cross-forest user policy and roaming user profiles was enabled in domain ABC.com.

Also did a test : one way trust ,pki.com (trusting), fan.local(trusted) ,user f1.fan.local logon to client 1. pki.com as following:

Deploy a GPO on domain pki.com , and enable the policy : Allow cross-forest user policy and roaming user profiles.

Create a GPO for f1 in fan.local, set a mapping drive policy and hide all the items in desktop policy.

Then when user f1.fan.local logon to client 1. pki.com, all the uer policies (mapping drive policy and hide all the items in desktop policy)applied as following:

Since it is a one way trust, it only works for the situation when users from trusted domain logon to trusting domain.

Answer 2

Hi FanFan,

thanks for your reply...

Had discussion with the customer, they want to configure one way trust between ABC.com & XYZ.com and whatever group policies they applying on ABC.com that policies replicate to XYZ.com, means all policies they want to managed from ABC.com.

They don't want to access resources of other domains. only Group policies of XYZ.com this forest, they want to managed from ABC.com.

is this possible ?

Answer 3

Hi FanFan,

Customer want to configure one way trust between ABC.com and XYZ.com, but they are not going to use any resources of cross domain. They just want to managed group policy of XYZ.com forest from ABC.com forest.

**when users from XYZ.com need to logon to workstation in domain ABC.com,right?
==> they don't want to use any cross forest resources.

Answer 4

Hi,
Welcome to share your current situation if there are any updates.
Please feel free to let us know if you need further assistance.
 
Best Regards,