Removing Default Transitive Trusts - Parent/Child

---

Hi Mike Rodrick.
I was watching the episode you did, MCSA Windows Server 2016 - 70-742, "Active Directory Trusts". Nice job.
I have a question. In my home lab, I was trying to replicate your domain setup. I created a parent domain, then I created a child domain. With the default transitive trusts, I tested this out by creating a shared folder on both the parent and child domain servers. With user accounts I created, I was able to access and write to these shared folders.
As you mentioned in your show, on the parent domain - Domain Controller, in Active Directory Domains and Trusts, I right-clicked on my parent domain > properties, then clicked the "Trusts" tab.
Under the column "Domain Name", in each section (outgoing and incoming trusts), I see my child domain.
My question is, how come I can't remove the child domain from either section? When I select the child domain, the "Remove" button is greyed out. I confirmed the user account that I'm logging into the domain controllers is a member of the "Domain Admin" and "Enterprise Admin" groups.

I want to make it a 1-way trust. Doesn't really matter which direction at the moment, as this is just a test lab. But I would like to know for my real life job when the time comes.

Am I missing a step?
Thank you.

Hello @Tracy-Sneed,

I'm glad you are enjoying the shows!

You are not missing a step. By design, you cannot remove the default trusts that are created between parent-child domains or between tree roots. In order to test a one-way trust, you would need to create separate forests. Then you could manually create a trust between to domains in separate forests.

In the real world, the solution would depend on your end goal.

If the end goal was complete separation, two forests would be the solution. Then all access would have to be specifically granted. There would also be true administrative separation.

If the end goal was to prevent access to certain resources, like logging in to certain machines or accessing certain shares, etc., Group Policy could be used.

Hope this helps,

Mike

Hi @Mike-Rodrick
My goal would be to have 1 Forest, a parent domain, and a child-domain, with a 1-way Trust.
So, just to confirm I understand you, with the parent-child domain setup, like my lab, you are forced to always have a 2-way transitive trust, since you can't remove this default trusts that are created with the parent-child domains, or between tree roots?

Thanks.

Hi @Mike-Rodrick . I just wanted to send you a quick follow-up from my previous post. Just wanted to double-confirm with you if I understand your answer.
Thanks.

Hey @Tracy-Sneed ,

Sorry, I've been out of the office for a little while.

Yep, you are stuck with the two-way transitive trust created between parent-child domains (and tree roots). This is by design, it makes administering multi-domain environments easier.

If you need true separation, you will have to create a separate forest. Then you can manually create whatever trusts you need, in one or both directions.

Hi @Mike-Rodrick . Thank you so much for the clarification. This makes sense.
You've answered my question completely.