AD Forests two way trust - Disaster Recovery

Question

I have 2 AD forest, A and B. Configured two way trust. In forest B there is 2 AD site which is site A and B.

Site A holding the fsmo roles. I'm going to bring down site A for a DR drill test without moving the FSMO to site B.

In this case, will the trust relationship still maintain without any issue?

Answer 1

Hi @Marcus Wong Theen Nam

Yes the trust relationship will be maintained without any issue.

Trust relationships enable access to resources can be either one-way or two-way. A one-way trust is a unidirectional authentication path created between two domains. In a one-way trust between Domain A and Domain B, users in Domain A can access resources in Domain B.

Some one-way trusts can be either non-transitive or transitive depending on the type of trust being created.

Here is a link as well to understand https://learn.microsoft.com/en-us/azure/active-directory-domain-services/concepts-forest-trust

-----
--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 2

Hi @Marcus Wong Theen Nam

This isn't a simple yes or no answer, as there are many factors that could impact resource access across the trust. i.e.

1. Are there domain controllers for forest A in site B
2. Are there any dependencies in site A
3. Do workstations and servers in site B have their client DNS setting include DCs in Site A and Site B

By not moving the FSMO roles and depending on how long Site A is offline, you could face problems with object creation, users will experience a longer timeout for incorrect password.

Gary.