Historically, we manage Active Directory trusts with NetDom.exe, this tool is around since so many years, you’ll found so many resources on Internet. But today, we are in 2015, and PowerShell is king now, let’s see how we can use it to manage Active Directory trusts.
Active Directory Trusts PowerShell
The .Net Framwork provide us a namespaces for working with Directory Services :
As their names suggest, one for forests and one for domains. Each of those have statics methods :
[System.DirectoryServices.ActiveDirectory.Forest] | Get-Member -Static [System.DirectoryServices.ActiveDirectory.Domain] | Get-Member -Static
You can use them to get the current domain :
Once you got the domain, you can ask for a lot more :
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() | Get-Member
Here we come, we now have access to some trusts methods.
If you want more information about that trust, you can ask about selective authentication and SIDFiltering :
You can disable SID filtering :
In case you have any doubts :
Almost everything we did this NetDom can be done with those methods :
NetDom can retire peacefully, PowerShell got our back 🙂
You can use the forest namespace as well, especially when dealing with forest trusts and multi-domain forest.
The big advantage of PowerShell over NetDom is the ability to automate, with error handling and logging, without any dependences.