Q: When administrators set up trust relationships between forests in a Windows Server 2003 environment, they can enable a feature that Microsoft refers to as selective authentication. What is this feature and how can administrators use it to fine-tune interforest security traffic?
A: When you enable the selective authentication feature of a forest trust relationship, users accessing cross-forest resources from one forest cannot authenticate to a domain controller or resource server (e.g., file server, print server) in the other forest unless they are explicitly allowed to do so. Selective authentication is available for both forest and external trust relationships if both forests are at the highest Windows Server 2003 functional level. This highest functional level, which is also Windows Server 2003's native functional level, requires that all domain controllers run Windows Server 2003.
Microsoft added selective authentication in Windows Server 2003 to allow a more granular cross-forest trust definition. In beta versions of Windows Server 2003, Microsoft referred to selective authentication as the authentication firewall. When selective authentication isn't enabled, in terms of access control, all users from the foreign forest become almost perfect peers of the local forest users. This situation exists because foreign forest users are added to the Authenticated Users group of the local forest when they cross the trust. Even though foreign forest users also become members of the Authenticated Users group when you enable the selective authentication option, those users can authenticate to the local forest only after they pass an additional access-control check. Selective authentication is always configured on the outgoing side of a cross-forest trust relationship.
You can enable a forest trust relationship's selective authentication function from the Trust Wizard or from the properties of the trust relationship. To enable the function from the trust property sheet, select the Authentication tab and select Allow authentication only for selected resources in the local forest (as Figure 1 illustrates). When you try to access a resource in a foreign forest for which selective authentication has been enabled from a machine in the local forest, you'll see the error Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. . . .
Register
