| Server IP : 180.180.241.3 / Your IP : 216.73.216.252 Web Server : Microsoft-IIS/7.5 System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586 User : IUSR ( 0) PHP Version : 5.3.28 Disable Function : NONE MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /Windows/Help/Windows/en-US/ |
Upload File : |
MZ @ PE L ! @ 0 @ .rsrc @ @.its @ @ 0 H X | |4 V S _ V E R S I O N _ I N F O S t r i n g F i l e I n f o 0 4 0 9 0 4 b 0 b ! F i l e V e r s i o n 1 . 0 0 . 0 0 l " F i l e D e s c r i p t i o n C o m p i l e d M i c r o s o f t H e l p 2 . 0 T i t l e B F i l e S t a m p 9 8 A B 2 A 4 9 0 1 C A 0 4 1 F 4 J C o m p i l e r V e r s i o n 2 . 5 . 7 1 2 1 0 . 0 8 5 7 9 V C o m p i l e D a t e 2 0 0 9 - 0 7 - 1 4 T 0 1 : 0 8 : 2 8 > T o p i c C o u n t 8 0 0 0 0 0 0 0 0 0 0 0 0 0 A L e g a l C o p y r i g h t 2 0 0 5 M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . C C C C C C C C C C C C C D V a r F i l e I n f o $ T r a n s l a t i o n ti P I* ÚʻXITOLITLS ( X쌡^
V` x U CAOL P HH C ITSF # * O -Y쌡^
VY쌡^
VIFCM AOLL U IFCM AOLL / /$FXFtiAttribute/ /$FXFtiAttribute/BTREE1/$FXFtiAttribute/DATA /$FXFtiAttribute/PROPERTYIN /$FXFtiMain/ /$FXFtiMain/BTREEm/$FXFtiMain/DATA^/$FXFtiMain/PROPERTYcN/$Index/$ATTRNAME/$Index/$PROPBAG1/$Index/$STRINGSC2/$Index/$SYSTEMAp
/$Index/$TOC/ /$Index/$TOC/$domadmin b/$Index/$TOPICATTRp/$Index/$TOPICS1/$Index/$URLSTRu</$Index/$URLTBL1 /$Index/$VTAIDX /$Index/AssetId/ /$Index/AssetId/$BL0; /$Index/AssetId/$LEAF_COUNTS;/$Index/AssetId/$LEAVESC /$OBJINSTb /assets/ 0/assets/0011ec45-8051-41b2-b8ef-30b9161d3223.xml t0/assets/01e41315-a9b3-4f64-95db-f7147bcf1adf.xml r0/assets/04c5a443-d7b3-4cc1-932f-c720a8e9cb41.xml }+0/assets/0b564360-4440-4dfb-bcda-a3f20406de88.xml (V0/assets/0c97d612-762b-4bba-a158-036c1497446c.xml ~T0/assets/14b8a443-1d98-45a6-b3fa-74b80fc44519.xml R0/assets/230ae7d6-352d-41d6-880d-f02052f6996c.xml Q 0/assets/2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b.xml n"0/assets/2e8f3ff1-225c-46e4-9061-e758df8befa4.xml '0/assets/36b61c6d-d4b8-4e1e-bd78-db8204285408.xml 7 0/assets/471131f7-9aa2-4f3b-ad0b-03caf9a9ea07.xml V 0/assets/5378c53f-ef40-4cdd-96a6-911ba6056083.xml tL0/assets/574bd0d8-1816-4d1e-bb78-61ffbd84ee34.xml @0/assets/6472046a-30dd-4dc9-92e0-450cebdafc90.xml E0/assets/6d35ab81-0b60-4425-8c95-46f676d1ea69.xml 0/assets/6e36265c-863a-4f03-92b9-ee994e61b34f.xml 0/assets/7296dc81-0672-4023-9937-c060fd7eef2f.xml .0/assets/72bf4a7d-660e-489f-b475-bea95e8d126c.xml 6A0/assets/791d01b9-2b81-446f-a4ae-75a5a1241a7e.xml wN0/assets/79feb454-7529-4742-9f39-5d6c0696e6c1.xml E0/assets/7a01372b-6eb1-4175-b9ff-8c330a616021.xml Vn0/assets/80304139-ee6b-43f0-bc4f-6a4196392d4d.xml D0/assets/80ae74bb-ccdd-4448-91f3-0038de553d9d.xml Qf0/assets/828a249f-9fd5-405f-9cd7-0657de4065a4.xml 7[0/assets/845f4f62-9231-44f6-ac76-572da9d09321.xml 0/assets/8c0cd186-a239-454b-9789-cef187236918.xml .S0/assets/991d570b-7d58-42bb-ad11-12045ebe1ec5.xml 0/assets/9e88fe6b-2c8c-4c1a-bc78-21e807eecbba.xml {0/assets/9ef8c5ac-341e-4473-963b-32b67ff58c29.xml .(0/assets/a43bb3e4-77b3-4b2e-adbd-d154b346781a.xml V0/assets/aae18246-025a-44ff-84a5-fccabd63038f.xml m'0/assets/c88ba049-2635-4cc8-8f00-76cbeefe18b8.xml 0/assets/d50bbb29-2ae1-4d47-bdb3-dc47efc111cf.xml J&0/assets/e1d983b5-7817-4972-b6fa-28c3f8577e69.xml p=0/assets/e1ed9885-3d41-4ef4-999a-bfa40d54808e.xml -l0/assets/fb14e09d-f63b-4341-a8cf-0cad098888c4.xml {0/assets/ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1.xml )
/domadmin.h1c =
/domadmin.H1F UO
/domadmin.H1T -O
/domadmin.H1V $ /domadmin_AssetId.H1K |k/domadmin_BestBet.H1K gk/domadmin_LinkTerm.H1K Rl/domadmin_SubjectTerm.H1K >o/relatedAssets/ 7/relatedAssets/1f6970c2-62d3-482d-a78a-451d4333f511.gif Xy7/relatedAssets/218c5e4d-e17e-4dce-8fa8-d37ff02fe8bb.gif 7/relatedAssets/46681e5b-fb4c-45bf-a19b-990ded5bc71b.gif Y:7/relatedAssets/722538bd-6535-4406-8c6c-c1e5170c4063.gif %%7/relatedAssets/938e20ba-8457-4f6c-83a0-e428a15c3e70.gif -::DataSpace/NameList <(::DataSpace/Storage/MSCompressed/Content -h,::DataSpace/Storage/MSCompressed/ControlData T )::DataSpace/Storage/MSCompressed/SpanInfo L/::DataSpace/Storage/MSCompressed/Transform/List <_::DataSpace/Storage/MSCompressed/Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/InstanceData/ i::DataSpace/Storage/MSCompressed/Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/InstanceData/ResetTable X3::Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/
d
q^K8&CS p U U n c o m p r e s s e d M S C o m p r e s s e d FX쌡^
V3 LZXC HH <maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Troubleshooting Active Directory Domains and Trusts</maml:title><maml:introduction>
<maml:para>This section describes a few issues that you might encounter when you use Active Directory Domains and Trusts to manage domains and trusts.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>What problem are you having?</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Clients are not able to access resources in a domain outside the forest</maml:linkText><maml:uri href="mshelp://windows/?id=0011ec45-8051-41b2-b8ef-30b9161d3223#BKMK_1"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>There are trust errors between servers and workstations</maml:linkText><maml:uri href="mshelp://windows/?id=0011ec45-8051-41b2-b8ef-30b9161d3223#BKMK_2"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>There are trust errors between Windows NT 4.0 domains and Active Directory domains</maml:linkText><maml:uri href="mshelp://windows/?id=0011ec45-8051-41b2-b8ef-30b9161d3223#BKMK_3"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section address="BKMK_1">
<maml:title>Clients are not able to access resources in a domain outside the forest.</maml:title><maml:introduction>
<maml:para><maml:phrase>Cause:</maml:phrase> A failure occurred on the external trust between the domains.</maml:para>
<maml:para><maml:phrase>Solution:</maml:phrase> Reset and verify the trust between the domains. For a trust to be reset successfully, the domain controller that holds the primary domain controller (PDC) emulator operations master role (also known as flexible single master operations or FSMO) must be available.</maml:para>
<maml:para></maml:para>
</maml:introduction></maml:section>
<maml:section address="BKMK_2">
<maml:title>There are trust errors between servers and workstations.</maml:title><maml:introduction>
<maml:para><maml:phrase>Cause:</maml:phrase> There is incorrect time synchronization between domain controllers or workstations, the server might be down, or the trust relationship might be broken.</maml:para>
<maml:para><maml:phrase>Solution:</maml:phrase> Run the command-line tool Netdom to verify, reset, or establish the trust between computers. This command-line tool performs batch management of trusts, verifies trusts, and secures channels between computers. It can also join computers to domains. For more information, see <maml:navigationLink><maml:linkText>Verify a Trust</maml:linkText><maml:uri href="mshelp://windows/?id=574bd0d8-1816-4d1e-bb78-61ffbd84ee34"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section>
<maml:section address="BKMK_3">
<maml:title>There are trust errors between Windows NT 4.0 domains and Active Directory domains.</maml:title><maml:introduction>
<maml:para><maml:phrase>Cause:</maml:phrase> Automatic trust password resets for the trust may not reach the PDC emulator master role holder.</maml:para>
<maml:para><maml:phrase>Solution:</maml:phrase> Run Netdom to verify, reset, or establish trust between computers. This command-line tool performs batch management of trusts, verifies trusts, and secures channels between computers. It can also join computers to domains. If this does not help solve the issue, see article Q317178 in the Microsoft Knowledge Base (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=4441</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=4441"></maml:uri></maml:navigationLink>).</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Active Directory Domains and Trusts</maml:title><maml:introduction>
<maml:para>Active Directory® Domains and Trusts is the Microsoft Management Console (MMC) snap-in that you can use to administer domain trusts, domain and forest functional levels, and user principal name (UPN) suffixes.</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Domains and Forests</maml:linkText><maml:uri href="mshelp://windows/?id=ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Forest Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=fb14e09d-f63b-4341-a8cf-0cad098888c4"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Troubleshooting Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=0011ec45-8051-41b2-b8ef-30b9161d3223"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Resources for Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=791d01b9-2b81-446f-a4ae-75a5a1241a7e"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>User Interface: Active Directory Domains and Trusts</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Raise Forest Functional Level Dialog Box</maml:linkText><maml:uri href="mshelp://windows/?id=0c97d612-762b-4bba-a158-036c1497446c"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Change Forest Dialog Box</maml:linkText><maml:uri href="mshelp://windows/?id=c88ba049-2635-4cc8-8f00-76cbeefe18b8"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Active Directory Domains and Trusts - UPN Suffixes Tab</maml:linkText><maml:uri href="mshelp://windows/?id=14b8a443-1d98-45a6-b3fa-74b80fc44519"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Domain Properties - Trusts Tab</maml:linkText><maml:uri href="mshelp://windows/?id=e1ed9885-3d41-4ef4-999a-bfa40d54808e"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Trusts Properties - General Tab</maml:linkText><maml:uri href="mshelp://windows/?id=5378c53f-ef40-4cdd-96a6-911ba6056083"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Trust Properties - Name Suffix Routing Tab</maml:linkText><maml:uri href="mshelp://windows/?id=471131f7-9aa2-4f3b-ad0b-03caf9a9ea07"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>SID Filtering Dialog Box - Securing External Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=2e8f3ff1-225c-46e4-9061-e758df8befa4"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Raise the Domain Functional Level</maml:title><maml:introduction>
<maml:para>When you install Active Directory Domain Services (AD DS) on a server running Windows Server 2008 R2, a set of basic Active Directory features is enabled by default. In addition to the basic Active Directory features on individual domain controllers, there are new domain-wide and forest-wide Active Directory features available when all domain controllers in a domain or forest are running Windows Server 2008 R2.</maml:para>
<maml:para>For the new domain-wide features to be enabled, all domain controllers in the domain must be running Windows Server 2008 R2, and the domain functional level must be raised to Windows Server 2008 R2.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To raise the domain functional level</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain for which you want to raise functional level, and then click <maml:ui>Raise Domain Functional Level</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In <maml:ui>Select an available domain functional level</maml:ui>, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To raise the domain functional level to Windows Server 2008, click <maml:ui>Windows Server 2008</maml:ui>, and then click <maml:ui>Raise</maml:ui>.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To raise the domain functional level to Windows Server 2008 R2, click <maml:ui>Windows Server 2008 R2</maml:ui>, and then click <maml:ui>Raise</maml:ui>.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
<maml:alertSet class="caution"><maml:title>Caution </maml:title>
<maml:para>Do not raise the domain functional level to a later version (such as Windows Server 2008 or Windows Server 2008 R2) if you have or will have any domain controllers running earlier versions of Windows Server. </maml:para>
</maml:alertSet>
<maml:alertSet class="important"><maml:title>Important </maml:title>
<maml:para>After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008. You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
</maml:para>
</maml:alertSet>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>You can also raise the domain functional level by right-clicking a domain in the Active Directory Users and Computers snap-in, and then clicking <maml:ui>Raise Domain Functional Level</maml:ui>.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The current domain functional level is displayed under <maml:ui>Current domain functional level</maml:ui> in the <maml:ui>Raise domain functional level</maml:ui> dialog box.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem><maml:para>You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell™. To open the Active Directory module, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Module for Windows PowerShell</maml:ui>. For more information, see Raise the Domain Functional Level (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=137825</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=137825"></maml:uri></maml:navigationLink>). For more information about Windows PowerShell, see Windows PowerShell (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkID=102372</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=102372"></maml:uri></maml:navigationLink>).
</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Domains and Forests</maml:linkText><maml:uri href="mshelp://windows/?id=ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Raise Forest Functional Level Dialog Box</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Item</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Details</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Forest name</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the name of the selected forest. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Current forest functional level</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the current setting of the forest functional level. </maml:para>
<maml:para>After you set this option to a certain value, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
</maml:para>
<maml:para>The functional level of a domain or forest only defines the set of Windows operating systems that can run on domain controllers. It does not define the client operating systems that are supported in the forest. </maml:para>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Active Directory Domains and Trusts - UPN Suffixes Tab</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Item</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Details</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Alternative UPN Suffixes</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Provides a space for you to type the name of the alternative user principal name (UPN) suffix. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Add</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to add the alternative UPN suffix. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Remove</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to remove the selected alternative UPN suffix. </maml:para>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Checklist: Create a Forest Trust</maml:title><maml:introduction>
<maml:para>Before you create forest trusts between domains, it is important to verify that the Domain Name System (DNS) server in your environment is properly set up and configured to accept future trust relationships. Complete the tasks in this checklist in order. When a reference link takes you to a conceptual topic, return to this topic after you review the conceptual topic so that you can proceed with the remaining tasks in this checklist. </maml:para>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Task</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Reference</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Ensure that DNS is set up properly. </maml:para>
</maml:listItem>
</maml:list>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Verify a zone delegation using the nslookup command (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92715</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92715"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>If there is a root DNS server that can be the root DNS server for both of the forest DNS namespaces, make it the root server by ensuring that the root zone contains delegations for each of the DNS namespaces. Also, update the root hints of all DNS servers with the new root DNS server. </maml:para>
</maml:listItem>
</maml:list>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Update root hints on the DNS server (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92717</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92717"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>If there is no shared root DNS server and the root DNS servers for each forest DNS namespace are running a Windows Server 2008 or a Windows Server 2008 R2 operating system, configure DNS conditional forwarders in each DNS namespace to route queries for names in the other namespace.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Configure DNS server forwarders (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92718</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92718"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>If there is no shared root DNS server and the root DNS servers for each forest DNS namespace are not running a Windows Server 2008 or a Windows Server 2008 R2 operating system, configure DNS secondary zones in each DNS namespace to route queries for names in the other namespace.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Add a secondary server for an existing zone (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92719</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92719"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Create the forest trust.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Create a Forest Trust</maml:linkText><maml:uri href="mshelp://windows/?id=828a249f-9fd5-405f-9cd7-0657de4065a4"></maml:uri></maml:navigationLink>.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Create a Shortcut Trust</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to create shortcut trusts.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase>, or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Creating a shortcut trust</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using the Windows interface</maml:linkText><maml:uri href="mshelp://windows/?id=2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b#BKMK_winui"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using a command line</maml:linkText><maml:uri href="mshelp://windows/?id=2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b#BKMK_cmd"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section address="BKMK_winui"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To create a shortcut trust using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain node for the domain that you want to establish a shortcut trust with, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, click <maml:ui>New Trust</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trust Name</maml:ui> page, type the Domain Name System (DNS) name (or NetBIOS name) of the domain, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Direction of Trust</maml:ui> page, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To create a two-way shortcut trust, click <maml:ui>Two-way</maml:ui>.</maml:para>
<maml:para>Users in this domain and users in the specified domain will be able to use this trust path.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way incoming shortcut trust, click <maml:ui>One-way:incoming</maml:ui>.</maml:para>
<maml:para>Users in the specified domain will not be able to use this trust path.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way outgoing shortcut trust, click <maml:ui>One-way:outgoing</maml:ui>.</maml:para>
<maml:para>Users in this domain will not be able to use this trust path.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Continue to follow the instructions in the wizard.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you have the appropriate administrative credentials for each domain, you can create both sides of a shortcut trust at the same time by clicking <maml:ui>Both this domain and the specified domain</maml:ui> on the <maml:ui>Sides of Trust</maml:ui> page. </maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section address="BKMK_cmd"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To create a shortcut trust using a command line</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open a command prompt. To open a command prompt, click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>cmd</maml:userInput>, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Type the following command, and then press ENTER: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d:<TrustedDomainName> /add</dev:code>
</maml:section></maml:sections></maml:step></maml:procedure>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Parameter</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Description</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>netdom trust</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Manages or verifies the trust relationship between domains.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustingDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the DNS name (or NetBIOS name) of the trusting domain in the trust that is being created.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/d:</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that the DNS domain name that follows is a trusted domain.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustedDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the DNS name (or NetBIOS name) of the domain that will be trusted in the trust being created.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/add</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that a trust be created.</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:</maml:para>
<dev:code>netdom trust | more </dev:code>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support. You can verify shortcut trusts, external trusts, and forest trusts, but not realm trusts.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You can use other parameters to assign a password or determine the direction of the trust. For example, to make the trust in this procedure a two-way, transitive trust, use the following syntax: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d: <TrustedDomainName> /add /twoway</dev:code>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>SID Filtering Dialog Box - Securing External Trusts</maml:title><maml:introduction>
<maml:para>To improve the security of Active Directory forests, domain controllers running Windows Server 2008 or Windows Server 2008 R2 enable security identifier (SID) filtering by default on all new, outgoing, external trusts. When SID filtering is applied to outgoing external trusts, malicious users who have domain-administrator-level access in the trusted domain are more likely to be prevented from granting—to themselves or to other user accounts in their domain—elevated user rights to the trusting domain.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Understanding the threat</maml:title><maml:introduction>
<maml:para>When SID filtering is not enabled on outgoing external trusts, a malicious user with administrative credentials in the trusted domain may be able to "sniff" network authentication requests from the trusting domain to obtain the SID information of a user, such as a domain administrator, who has full access to resources in the trusting domain.</maml:para>
<maml:para>After obtaining the domain administrator's SID from the trusting domain, a malicious user with administrative credentials can add that SID to a user account's <maml:phrase>SIDHistory</maml:phrase> attribute in the trusted domain and attempt to gain full access to the trusting domain and the resources in that domain. In this scenario, a malicious user who has domain administrator credentials in the trusted domain is a threat to the entire trusting forest. </maml:para>
<maml:para>SID filtering helps neutralize the threat of malicious users in the trusted domain using the <maml:phrase>SIDHistory</maml:phrase> attribute to gain elevated privileges.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>How SID filtering works</maml:title><maml:introduction>
<maml:para>When security principals are created in a domain, the domain SID is included in the security principal's SID to identify the domain in which the security principal was created. The domain SID is an important characteristic of a security principal because the Windows security subsystem uses it to verify the security principal's authenticity.</maml:para>
<maml:para>In a similar fashion, outgoing external trusts that are created from the trusting domain use SID filtering to verify that incoming authentication requests from security principals in the trusted domain contain only the SIDs of security principals in the trusted domain. This is accomplished through a comparison of the SIDs of the incoming security principal to the domain SID of the trusted domain. If any of the security principal SIDs includes a domain SID other than the SID from the trusted domain, the trust removes the offending SID.</maml:para>
<maml:para>SID filtering helps ensure that any misuse of the <maml:phrase>SIDHistory</maml:phrase> attribute on security principals (including inetOrgPerson) in the trusted forest cannot pose a threat to the integrity of the trusting forest.</maml:para>
<maml:para>The <maml:phrase>SIDHistory</maml:phrase> attribute can be useful to domain administrators when they migrate user accounts and group accounts from one domain to another. Domain administrators can add SIDs from an old user account or group account to the <maml:phrase>SIDHistory</maml:phrase> attribute of the new, migrated account. By doing this, domain administrators give the new account the same level of access to resources as the old account.</maml:para>
<maml:para>If domain administrators cannot use the <maml:phrase>SIDHistory</maml:phrase> attribute in this way, they have to track down and reapply permissions for the new account on each network resource that the old account had access to. </maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Impact of SID filtering</maml:title><maml:introduction>
<maml:para>SID filtering on external trusts can affect your existing Active Directory infrastructure in the following two areas:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>SID history data that contains SIDs from any domain other than the trusted domain is removed from authentication requests that are made from the trusted domain. This results in access being denied to resources that have the user's old SID.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Your strategy for universal group access control between forests will require changes.</maml:para>
</maml:listItem>
</maml:list>
<maml:para>When you enable SID filtering, users who use SID history data for authorization to resources in the trusting domain no longer have access to those resources.</maml:para>
<maml:para>If you typically assign universal groups from a trusted forest to access control lists (ACLs) on shared resources in the trusting domain, SID filtering has a major impact on your access control strategy. Because universal groups must adhere to the same SID filtering guidelines as other security principal objects (that is, the universal group object SID must also contain the domain SID), verify that any universal groups that are assigned to shared resources in the trusting domain were created in the trusted domain. If the universal group in the trusted forest was not created in the trusted domain—even though it may contain users from the trusted domain as members—authentication requests from members of that universal group will be filtered and discarded. Therefore, before you assign access to resources in the trusting domain for users in the trusted domain, confirm that the universal group that contains the trusted domain users was created in the trusted domain.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>External trusts that are created from domain controllers running Windows 2000 Service Pack 3 (SP3) or earlier do not enforce SID filtering by default. To further secure your forest, consider enabling SID filtering on all existing external trusts that were created by domain controllers running Windows 2000 SP3 or earlier. You can do this by using Netdom.exe to enable SID filtering on existing external trusts or by recreating these external trusts from a domain controller running Windows Server 2008 or Windows Server 2008 R2.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You cannot turn off the default behavior that enables SID filtering for newly created external trusts.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For more information about configuring SID filtering settings (disabling or reapplying them), see Configuring SID Filter Quarantining on External Trusts (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92778</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92778"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Remove a Trust</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trust snap-in to remove trusts.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Removing a trust</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using the Windows interface</maml:linkText><maml:uri href="mshelp://windows/?id=36b61c6d-d4b8-4e1e-bd78-db8204285408#BKMK_winui"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using a command line</maml:linkText><maml:uri href="mshelp://windows/?id=36b61c6d-d4b8-4e1e-bd78-db8204285408#BKMK_cmd"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section address="BKMK_winui"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To remove a trust using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain that contains the trust that you want to remove, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, under either <maml:ui>Domains trusted by this domain (outgoing trusts)</maml:ui> or <maml:ui>Domains that trust this domain (incoming trusts)</maml:ui>, click the trust to be removed, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Do one of the following, and then click <maml:ui>OK</maml:ui>:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Click <maml:ui>No, remove the trust from the local domain only</maml:ui>.</maml:para>
<maml:para>If you select this option, we recommend that you repeat this procedure for the reciprocal domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Click <maml:ui>Yes, remove the trust from both the local domain and the other domain</maml:ui>.</maml:para>
<maml:para>If you select this option, you must type a user account and password with administrative credentials for the reciprocal domain.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>It is not possible to revoke the default two-way, transitive trusts between domains in a forest. It is possible to delete explicitly created shortcut trusts.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section address="BKMK_cmd"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To remove a trust using a command line</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open a command prompt. To open a command prompt, click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>cmd</maml:userInput>, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Type the following command, and then press ENTER: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d:<TrustedDomainName> /remove /UserD:<User> /PasswordD:*<Password></dev:code>
</maml:section></maml:sections></maml:step></maml:procedure>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Parameter</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Description</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>netdom trust</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Manages or verifies trust relationships between domains.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustingDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the Domain Name System (DNS) name of the trusting domain in the trust that is being removed.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/d:</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that the DNS domain name that follows is a trusted domain.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustedDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the DNS name of the domain that is trusted in the trust that is being removed.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/remove</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that a trust be removed.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><User></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the user account with administrative credentials for the reciprocal domain.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/UserD:</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the user account that is used to make the connection with the trusted domain.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/PasswordD:*</maml:para>
</maml:entry>
<maml:entry>
<maml:para>The password of the user account that is specified by <maml:computerOutputInline>/UserD</maml:computerOutputInline>.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><Password></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the password for the user account with administrative credentials for the reciprocal domain.</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:</maml:para>
<dev:code>netdom trust | more </dev:code>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support. You can verify trusts for shortcut trusts, external trusts, and forest trusts but not realm trusts.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Trust Properties - Name Suffix Routing Tab</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Item</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Details</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Name suffixes in the <DNS name> forest:</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:ui>Suffix</maml:ui>: A list of name suffixes in the local forest. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Routing</maml:ui>: Specifies the routing status of the corresponding name suffix. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Status</maml:ui>: Specifies the status (conflicts, whether the name suffix is newly created, and so on) of the corresponding name suffix. </maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Enable</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to set the routing status of the selected name suffix to Enabled. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Disable</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to set the routing status of the selected name suffix to Disabled. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Refresh</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to refresh the list of name suffixes in the local forest. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Edit</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to exclude name suffixes from routing to the local forest. </maml:para>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Trusts Properties - General Tab</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Item</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Details</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para><maml:ui>This Doman:</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Displays the fully qualified domain name (FQDN) of the domain that is the current focus of the Active Directory Domains and Trusts snap-in. </maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Other Domain:</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Displays the FQDN of the other domain in the selected trust relationship.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Trust type</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the type of the selected trust relationship.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>The other domain supports Kerberos AES Encryption</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies whether the other domain in the selected trust relationship supports Kerberos AES Encryption. </maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title>
<maml:para>Advanced Encryption Standard (AES) is a new encryption algorithm that has been standardized by the National Institute of Standards and Technology (NIST) and is expected to be widely used in the next several years. For more information about Kerberos authentication, see Kerberos Explained (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=85494</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=85494"></maml:uri></maml:navigationLink>).</maml:para>
</maml:alertSet>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Direction of trust</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the direction of the selected trust relationship.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Transitivity of trust</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies whether the selected trust relationship is transitive.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Validate</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to confirm or reset the selected trust relationship.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Save As</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to save a file with the details about the status of the names that is associated with the selected trust relationship.</maml:para>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Verify a Trust</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to verify whether the newly added shortcut, external, and forest trusts were created successfully. </maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Verifying a trust</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using the Windows interface</maml:linkText><maml:uri href="mshelp://windows/?id=574bd0d8-1816-4d1e-bb78-61ffbd84ee34#BKMK_winui"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using a command line</maml:linkText><maml:uri href="mshelp://windows/?id=574bd0d8-1816-4d1e-bb78-61ffbd84ee34#BKMK_cmd"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section address="BKMK_winui"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To verify a trust using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain that contains the trust that you want to verify, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, under either <maml:ui>Domains trusted by this domain (outgoing trusts)</maml:ui> or <maml:ui>Domains that trust this domain (incoming trusts)</maml:ui>, click the trust to be verified, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click <maml:ui>Validate</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Do one of the following, and then click <maml:ui>OK</maml:ui>:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Click <maml:ui>No, do not validate the incoming trust</maml:ui>.</maml:para>
<maml:para>If you select this option, we recommend that you repeat this procedure for the reciprocal domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Click <maml:ui>Yes, validate the incoming trust</maml:ui>.</maml:para>
<maml:para>If you select this option, you must type a user account and password with administrative credentials for the reciprocal domain.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You can verify trusts for shortcut trusts, external trusts, and forest trusts, but not realm trusts.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section address="BKMK_cmd"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To verify a trust using a command line</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open a command prompt. To open a command prompt, click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>cmd</maml:userInput>, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Type the following command, and then press ENTER: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d:<TrustedDomainName> /verify</dev:code>
</maml:section></maml:sections></maml:step></maml:procedure>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Parameter</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Description</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>netdom trust</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Managers or verifies the trust relationship between domains.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustingDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the Domain Name System (DNS) name of the trusting domain in the trust that is being verified.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/d:</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that the DNS domain name that follows is the trusted domain.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustedDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the DNS name of the domain that is trusted in the trust that is being verified.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/verify</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Verifies that the trust is operating properly.</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:</maml:para>
<dev:code>netdom trust | more </dev:code>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You can verify trusts for shortcut, external, and forest trusts but not realm trusts.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Trust Types</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Trust Types</maml:title><maml:introduction>
<maml:para>You can use the New Trust Wizard or the Netdom command-line tool to create four types of trusts: external trusts, realm trusts, forest trusts, and shortcut trusts. The following table describes these trust types.</maml:para>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Trust type</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Transitivity</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Direction</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Description</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>External</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Nontransitive</maml:para>
</maml:entry>
<maml:entry>
<maml:para>One-way or two-way</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Use external trusts to provide access to resources that are located on a Windows NT 4.0 domain or a domain that is located in a separate forest that is not joined by a forest trust. For more information, see <maml:navigationLink><maml:linkText>Understanding When to Create an External Trust</maml:linkText><maml:uri href="mshelp://windows/?id=d50bbb29-2ae1-4d47-bdb3-dc47efc111cf"></maml:uri></maml:navigationLink>. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Realm</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Transitive or nontransitive</maml:para>
</maml:entry>
<maml:entry>
<maml:para>One-way or two-way</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Use realm trusts to form a trust relationship between a non-Windows Kerberos realm and a Windows Server 2008 or a Windows Server 2008 R2 domain. For more information, see <maml:navigationLink><maml:linkText>Understanding When to Create a Realm Trust</maml:linkText><maml:uri href="mshelp://windows/?id=9e88fe6b-2c8c-4c1a-bc78-21e807eecbba"></maml:uri></maml:navigationLink>.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Forest</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Transitive </maml:para>
</maml:entry>
<maml:entry>
<maml:para>One-way or two-way</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Use forest trusts to share resources between forests. If a forest trust is a two-way trust, authentication requests that are made in either forest can reach the other forest. For more information, see <maml:navigationLink><maml:linkText>Understanding When to Create a Forest Trust</maml:linkText><maml:uri href="mshelp://windows/?id=79feb454-7529-4742-9f39-5d6c0696e6c1"></maml:uri></maml:navigationLink>.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Shortcut</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Transitive </maml:para>
</maml:entry>
<maml:entry>
<maml:para>One-way or two-way</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Use shortcut trusts to improve user logon times between two domains within a Windows Server 2008 or a Windows Server 2008 R2 forest. This is useful when two domains are separated by two domain trees. For more information, see <maml:navigationLink><maml:linkText>Understanding When to Create a Shortcut Trust</maml:linkText><maml:uri href="mshelp://windows/?id=6d35ab81-0b60-4425-8c95-46f676d1ea69"></maml:uri></maml:navigationLink>.</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>When you create external trusts, shortcut trusts, realm trusts, or forest trusts, you have the option to create each side of the trust separately or both sides of a trust simultaneously. </maml:para>
<maml:para>If you choose to create each side of the trust separately, you must run the New Trust Wizard twice—once for each domain. When you create trusts using the method, you must supply the same trust password for each domain. As a security best practice, all trust passwords should be strong passwords. For more information, see Strong passwords (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92697</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92697"></maml:uri></maml:navigationLink>).</maml:para>
<maml:para>If you choose to create both sides of the trust simultaneously, you run the New Trust Wizard once. When you choose this option, a strong trust password is automatically generated for you. You must have the appropriate administrative credentials for the domains between which you are creating the trust.</maml:para>
<maml:para>For more information about trusts, see <maml:navigationLink><maml:linkText>Understanding Trust Transitivity</maml:linkText><maml:uri href="mshelp://windows/?id=80ae74bb-ccdd-4448-91f3-0038de553d9d"></maml:uri></maml:navigationLink> and <maml:navigationLink><maml:linkText>Understanding Trust Direction</maml:linkText><maml:uri href="mshelp://windows/?id=a43bb3e4-77b3-4b2e-adbd-d154b346781a"></maml:uri></maml:navigationLink>. </maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual>GIF89a && YYBrffL??/33&_̙|iLL9 rrVffooyyO??Ʃ̳Ҽyyyuuupppooohhhfffccc```___PPPOOOFFFBBB@@@???000///&&& , DRMR!Ƹβܦ远
p
"\p#z("D3 Ĩ? C);&SC%8.fPp aU
)LF Ьu x 2 BS8Йh,H};! B 5 յ<Q )Nyv]20:SXPG$8ũ֮m d
F( A#]+;ذҨ=E-z(
t T
/gͻ wC 9zE #j`\_/$ "ӫ_Ͼ=z @|-&>m5
P%GqF(p]A(#xg` p5^pw~ ] Pa<fdSI(8Ե M<A0bx5U7
.>J
0gsU)Cs;I0wf41e}[
! Cm\jQ, hg"TÞ&:.c^eigu٧g Dק1&;kcjPLc%@ĔN
""
= Jc,,ʹɺbؾ->m5"~uʸhM;
X¸k;G_F/aUplP i' jGXv*H@֖ЋpI,r$3 7L*1& 2/3B Ct=N,5N51RO \]LZ51^vC
e cl9MC7BBHõԴ0
&?>+Vȡ@M<
IL)
FlX}
ˡ(1s/T<`H6JC r˳
D5M8Й QQV^^x+ˆBBQ74G @Þ|3'B )/@]͂|PS@f`Q}j4u݆P 0IX+l@@ 0(BsH L PrTMՓ<܈IN'` Ea DZ 3Pm1{ ̜O ( %#7hR(%ٌ >0.1=Dۜnj8؇E
RH!@Anzd<[q l`P <R (GIRLO8Љ ɱKa34(4Ax!8C\ 33RL/B8R<2r~Ɯ$+ 1 `'" L:vhT')Qc?<$~d:U $t a5=OivcU`ė :_"PbQ` hdF~ihL{!Jܳ^-
NFCkgd%թ8ԯTuC vF{]5YWwڥFEg}9ZxΨFZjD++58Wq^Bl zWJE
ce
ZtmEfM1 Dd֮֞h- `ۊBmjY>˷(qN(w1m
\GXjK
HM @ A
T20aRv,݊/'< Ic@QMI0><jP 1F<U"Rb"ҟ^s~B"S9%"`bwCHb='Yΐ.a xCh2I![J>[aA!8$9(Жِ QyHSC<$-{S?JAXÀҜ!qK eȓtTNjrF)(,.˯/"eA̧ԍ܅nj 3J?eOPӎqD* ޝD]J!1\n-"Uz$ ijyb,im&74ȱUv}]hns_Pڽs(ݭ!ZM
JwaX [}rO랶gV
o;g,[GZq+gl(04v[ֶUyi) s^ V?_vؐ-t*9:MNԣSAztX:ؙ.?f:^ o.#n{C | ?<o])-'O[B ;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding When to Create a Shortcut Trust</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>When to create a shortcut trust</maml:title><maml:introduction>
<maml:para>Shortcut trusts are one-way or two-way, transitive trusts that administrators can use to optimize the authentication process. </maml:para>
<maml:para>Authentication requests must first travel a trust path between domain trees. In a complex forest this can take time, which you can reduce with shortcut trusts. A trust path is the series of domain trust relationships that authentication requests must traverse between any two domains. Shortcut trusts effectively shorten the path that authentication requests travel between domains that are located in two separate domain trees. For more information about trust paths, see <maml:navigationLink><maml:linkText>Understanding Trust Direction</maml:linkText><maml:uri href="mshelp://windows/?id=a43bb3e4-77b3-4b2e-adbd-d154b346781a"></maml:uri></maml:navigationLink>. </maml:para>
<maml:para>Shortcut trusts are necessary when many users in a domain regularly log on to other domains in a forest. Using the following illustration as an example, you can form a shortcut trust between domain B and domain D, between domain A and domain 1, and so on.</maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=46681e5b-fb4c-45bf-a19b-990ded5bc71b" mimeType="image/gif"><maml:summary>Shortcut trusts in a forest</maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:para>For more information about how to create a shortcut trust, see <maml:navigationLink><maml:linkText>Create a Shortcut Trust</maml:linkText><maml:uri href="mshelp://windows/?id=2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b"></maml:uri></maml:navigationLink>. </maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Using one-way trusts</maml:title><maml:introduction>
<maml:para>A one-way, shortcut trust that is established between two domains in separate domain trees can reduce the time that is necessary to fulfill authentication requests—but in only one direction. For example, when a one-way, shortcut trust is established between domain A and domain B, authentication requests that are made in domain A to domain B can use the new one-way trust path. However, authentication requests that are made in domain B to domain A must still travel the longer trust path.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Using two-way trusts</maml:title><maml:introduction>
<maml:para>A two-way, shortcut trust that is established between two domains in separate domain trees reduces the time that is necessary to fulfill authentication requests that originate in either domain. For example, when a two-way trust is established between domain A and domain B, authentication requests that are made from either domain to the other domain can use the new, two-way trust path.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Domain and Forest Functionality</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Domain and forest functionality</maml:title><maml:introduction>
<maml:para>Domain and forest functionality, which is available in Windows Server® 2008 R2 Active Directory Domain Services (AD DS), provides a way to enable domain-wide features or forest-wide Active Directory features in your network environment. Different levels of domain functionality and forest functionality are available, depending on your network environment.</maml:para>
<maml:para>If all the domain controllers in your domain or forest are running Windows Server 2008 R2 and the domain and forest functional level is set to Windows Server 2008 R2, all domain-wide features and forest-wide features are available. When your domain or forest contains Windows® 2000, Windows Server 2003, or Windows Server 2008 domain controllers, Active Directory features are limited. For more information about how to enable domain-wide features or forest-wide features, see <maml:navigationLink><maml:linkText>Raise the Domain Functional Level</maml:linkText><maml:uri href="mshelp://windows/?id=0b564360-4440-4dfb-bcda-a3f20406de88"></maml:uri></maml:navigationLink> and <maml:navigationLink><maml:linkText>Raise the Forest Functional Level</maml:linkText><maml:uri href="mshelp://windows/?id=991d570b-7d58-42bb-ad11-12045ebe1ec5"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Domain functionality</maml:title><maml:introduction>
<maml:para>Domain functionality enables features that affect the entire domain and that domain only. In Windows Server 2008 R2 AD DS, four domain functional levels are available: Windows 2000 native, Windows Server 2003 (the default), Windows Server 2008, and Windows Server 2008 R2. </maml:para>
<maml:para>The following table lists the domain functional levels and their corresponding supported domain controllers:</maml:para>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Domain functional level</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Domain controllers supported</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Windows 2000 native</maml:para>
</maml:entry>
<maml:entry><maml:para>Windows 2000 Server</maml:para>
<maml:para>Windows Server 2003</maml:para>
<maml:para>Windows Server 2008</maml:para>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2003</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Windows Server 2003</maml:para>
<maml:para>Windows Server 2008</maml:para>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Windows Server 2008</maml:para>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>When you raise the domain functional level, domain controllers running earlier operating systems cannot be introduced into the domain. For example, if you raise the domain functional level to Windows Server 2008 R2, you cannot add domain controllers running Windows Server 2008 to the domain.</maml:para>
<maml:para>The following table describes the domain-wide features that are enabled for the Windows Server 2008 R2 AD DS domain functional levels.</maml:para>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Domain functional level</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Enabled features</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Windows 2000 native</maml:para>
</maml:entry>
<maml:entry>
<maml:para>All default Active Directory features and the following features:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Universal groups are enabled for both distribution groups and security groups.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Group nesting.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Group conversion is enabled, which makes conversion possible between security groups and distribution groups.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Security identifier (SID) history.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2003</maml:para>
</maml:entry>
<maml:entry>
<maml:para>All default Active Directory features, all features from the Windows 2000 native domain functional level, plus the following features:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>The availability of the domain management tool, Netdom.exe, to prepare for domain controller rename.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Update of the logon time stamp. The <maml:phrase>lastLogonTimestamp</maml:phrase> attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The ability to set the <maml:phrase>userPassword</maml:phrase> attribute as the effective password on the inetOrgPerson object and user objects.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The ability to redirect Users and Computers containers. By default, two well-known containers are provided for housing computer and user/group accounts: cn=Computers,<domain root> and cn=Users,<domain root>. This feature makes it possible to define a new well-known location for these accounts.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Authorization Manager can store its authorization policies in AD DS.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Constrained delegation is included, which makes it possible for applications to take advantage of the secure delegation of user credentials by means of the Kerberos authentication protocol. You can configure delegation to be allowed only to specific destination services.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Selective authentication is supported, which makes it possible to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest. </maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008</maml:para>
</maml:entry>
<maml:entry>
<maml:para>All default Active Directory features, all features from the Windows Server 2003 domain functional level, plus the following features:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Distributed File System Replication support for SYSVOL, which provides more robust and detailed replication of SYSVOL contents.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Advanced Encryption Services (AES 128 and 256) support for the Kerberos authentication protocol. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Last Interactive Logon Information, which displays the time of the last successful interactive logon for a user, from what workstation, and the number of failed logon attempts since the last logon.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Fine-grained password policies, which make it possible for password policies and account lockout policies to be specified for users and global security groups in a domain.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry>
<maml:entry>
<maml:para>All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorization based on a user’s logon method.</maml:para></maml:listItem>
</maml:list>
</maml:entry></maml:row>
</maml:table>
</maml:introduction></maml:section><maml:section>
<maml:title>Forest functionality</maml:title><maml:introduction>
<maml:para>Forest functionality enables features across all the domains in your forest. Four forest functional levels are available in Windows Server 2008 R2 operating system: Windows 2000, Windows Server 2003 (default), Windows Server 2008, and Windows Server 2008 R2. </maml:para>
<maml:para>The following table lists the forest functional levels available in Windows Server 2008 R2 operating system and their corresponding supported domain controllers.</maml:para>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Forest functional level</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Domain controllers supported</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Windows 2000</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Windows NT® 4.0</maml:para>
<maml:para>Windows 2000</maml:para>
<maml:para>Windows Server 2003</maml:para>
<maml:para>Windows Server 2008</maml:para>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2003 (default)</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Windows Server 2003</maml:para>
<maml:para>Windows Server 2008</maml:para>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Windows Server 2008</maml:para><maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>When you raise the forest functional level, domain controllers running earlier operating systems cannot be introduced into the forest. For example, if you raise the forest functional level to Windows Server 2008 R2, domain controllers running Windows Server 2008 cannot be added to the forest.</maml:para>
<maml:para>The following table describes the forest-wide features that are enabled for the Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 forest functional levels.</maml:para>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Forest functional level</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Enabled features</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2003</maml:para>
</maml:entry>
<maml:entry>
<maml:para>All default Active Directory features, plus the following features:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Forest trust</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Domain rename</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Linked-value replication (Changes in group membership store and replicate values for individual members instead of replicating the entire membership as a single unit.) This results in lower network bandwidth and processor usage during replication and eliminates the possibility of lost updates when different members are added or removed concurrently at different domain controllers.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The ability to deploy a read-only domain controller (RODC) that runs Windows Server 2008.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Improved Knowledge Consistency Checker (KCC) algorithms and scalability. The intersite topology generator (ISTG) uses improved algorithms that scale to support forests with a greater number of sites than can be supported at the Windows 2000 forest functional level. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The ability to create instances of the dynamic auxiliary class called <maml:phrase>dynamicObject</maml:phrase> in a domain directory partition.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The ability to convert an inetOrgPerson object instance into a User object instance, and the reverse.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The ability to create instances of the new group types, called application basic groups and Lightweight Directory Access Protocol (LDAP) query groups, to support role-based authorization.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Deactivation and redefinition of attributes and classes in the schema. </maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008</maml:para>
</maml:entry>
<maml:entry>
<maml:para>This functional level provides all of the features that are available at the Windows Server 2003 forest functional level, but no additional features. All domains that are subsequently added to the forest, however, will operate at the Windows Server 2008 domain functional level by default.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>Windows Server 2008 R2</maml:para>
</maml:entry>
<maml:entry><maml:para>All of the features that are available at the Windows Server 2003 forest functional level, plus the following features:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running.</maml:para></maml:listItem>
</maml:list>
<maml:para>All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default.</maml:para>
<maml:para>If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.</maml:para>
</maml:entry>
</maml:row>
</maml:table>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Domains and Forests</maml:linkText><maml:uri href="mshelp://windows/?id=ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Managing Trusts</maml:title><maml:introduction>
<maml:para>You can use Active Directory Domains and Trusts to manage domain trusts.</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=9ef8c5ac-341e-4473-963b-32b67ff58c29"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding Trust Types</maml:linkText><maml:uri href="mshelp://windows/?id=6472046a-30dd-4dc9-92e0-450cebdafc90"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding Trust Direction</maml:linkText><maml:uri href="mshelp://windows/?id=a43bb3e4-77b3-4b2e-adbd-d154b346781a"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding Trust Transitivity</maml:linkText><maml:uri href="mshelp://windows/?id=80ae74bb-ccdd-4448-91f3-0038de553d9d"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding When to Create an External Trust</maml:linkText><maml:uri href="mshelp://windows/?id=d50bbb29-2ae1-4d47-bdb3-dc47efc111cf"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding When to Create a Shortcut Trust</maml:linkText><maml:uri href="mshelp://windows/?id=6d35ab81-0b60-4425-8c95-46f676d1ea69"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding When to Create a Realm Trust</maml:linkText><maml:uri href="mshelp://windows/?id=9e88fe6b-2c8c-4c1a-bc78-21e807eecbba"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Create a Shortcut Trust</maml:linkText><maml:uri href="mshelp://windows/?id=2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Create an External Trust</maml:linkText><maml:uri href="mshelp://windows/?id=72bf4a7d-660e-489f-b475-bea95e8d126c"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Create a Realm Trust</maml:linkText><maml:uri href="mshelp://windows/?id=845f4f62-9231-44f6-ac76-572da9d09321"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Verify a Trust</maml:linkText><maml:uri href="mshelp://windows/?id=574bd0d8-1816-4d1e-bb78-61ffbd84ee34"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Remove a Trust</maml:linkText><maml:uri href="mshelp://windows/?id=36b61c6d-d4b8-4e1e-bd78-db8204285408"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Select the Scope of Authentication for Users</maml:linkText><maml:uri href="mshelp://windows/?id=7a01372b-6eb1-4175-b9ff-8c330a616021"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Create an External Trust</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to create external trusts.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase>, or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Creating an external trust</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using the Windows interface</maml:linkText><maml:uri href="mshelp://windows/?id=72bf4a7d-660e-489f-b475-bea95e8d126c#BKMK_winui"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using a command line</maml:linkText><maml:uri href="mshelp://windows/?id=72bf4a7d-660e-489f-b475-bea95e8d126c#BKMK_cmd"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section address="BKMK_winui"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To create an external trust using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain node for the domain that you want to establish a trust with, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, click the <maml:ui>New Trust</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trust Name</maml:ui> page, type the Domain Name System (DNS) name (or NetBIOS name) of the domain, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trust Type</maml:ui> page, click <maml:ui>External trust</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Direction of trust</maml:ui> page, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To create a two-way, external trust, click <maml:ui>Two-way</maml:ui>.</maml:para>
<maml:para>Users in this domain and users in the specified domain will be able to access resources in either domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way, incoming external trust, click <maml:ui>One-way:incoming</maml:ui>.</maml:para>
<maml:para>Users in the specified domain will not be able to access any resources in this domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way, outgoing external trust, click <maml:ui>One-way:outgoing</maml:ui>.</maml:para>
<maml:para>Users in this domain will not be able to access any resources in the specified domain.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Continue to follow the instructions in the wizard.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you have the appropriate administrative credentials for each domain, you can create both sides of an external trust at the same time by clicking <maml:ui>Both this domain and the specified domain</maml:ui> on the <maml:ui>Sides of Trust</maml:ui> page. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you want to allow users from the specified domain to obtain access to all the resources in this domain, click <maml:ui>Allow authentication for all resources</maml:ui> on the <maml:ui>Outgoing Trust Properties</maml:ui> page. Use this option when both domains belong to the same organization.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you want to restrict users in the specified domain from obtaining access to any of the resources in this domain, click <maml:ui>Allow authentication only for selected resources in the local domain</maml:ui> on the <maml:ui>Outgoing Trust Properties</maml:ui> page. Use this option when each domain belongs to a separate organization.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section address="BKMK_cmd"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To create an external trust using a command line</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open a command prompt. To open a command prompt, click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>cmd</maml:userInput>, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Type the following command, and then press ENTER: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d:<TrustedDomainName> /add</dev:code>
</maml:section></maml:sections></maml:step></maml:procedure>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Parameter</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Description</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>netdom trust</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Manages or verifies the trust relationship between domains.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustingDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the DNS name (or NetBIOS name) of the trusting domain in the trust that is being created.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/d:</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that the DNS domain name that follows is a trusted domain.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustedDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the DNS name (or NetBIOS name) of the domain that will be trusted in the trust that is being created.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/add</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that a trust be created.</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:</maml:para>
<dev:code>netdom trust | more </dev:code>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support. You can verify trusts for shortcut, external, and forest trusts but not realm trusts.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You can use other parameters to assign a password or determine the direction of the trust. For example, to make a two-way, transitive trust, use the following syntax: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d:<TrustedDomainName> /add /twoway </dev:code>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Resources for Active Directory Domains and Trusts</maml:title><maml:introduction>
<maml:para>For more information about objects that you manage with Active Directory Domains and Trusts, see the following resources on the Microsoft Web site:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>For information about read-only domain controllers, see Read-Only Domain Controllers Step-by-Step Guide (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92728</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92728"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For more information about the Kerberos protocol, see Kerberos Explained (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=85494</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=85494"></maml:uri></maml:navigationLink>). </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For more information about strong passwords, see Strong passwords: How to create and use them (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkID=58293</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=58293"></maml:uri></maml:navigationLink>). </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For more information about zone properties, see Configuring Zone Properties (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92779</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92779"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For more information about updating root hints on the DNS server, see Update Root Hints on the DNS Server (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92717</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92717"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For more information about DNS server forwarders, see Configure DNS server forwarders (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92718</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92718"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For more information about adding a secondary server to an existing zone, see Add a secondary server for an existing zone (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92719</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92719"></maml:uri></maml:navigationLink>). </maml:para>
</maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding When to Create a Forest Trust</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>When to create a forest trust</maml:title><maml:introduction>
<maml:para>You can create a forest trust only between a forest root domain in one Windows Server 2008 or Windows Server 2008 R2 forest and a forest root domain in another Windows Server 2008 or Windows Server 2008 R2 forest. Creating a forest trust between two Windows Server 2008 or Windows Server 2008 R2 forests provides a one-way or two-way, transitive trust relationship between every domain that resides within each forest. Forest trusts are useful for application service providers, organizations undergoing mergers or acquisitions, collaborative business extranets, and organizations seeking a solution for administrative autonomy.</maml:para>
<maml:para>For more information about creating forest trusts, see <maml:navigationLink><maml:linkText>Create a Forest Trust</maml:linkText><maml:uri href="mshelp://windows/?id=828a249f-9fd5-405f-9cd7-0657de4065a4"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Using one-way, forest trusts</maml:title><maml:introduction>
<maml:para>A one-way, forest trust between two forests allows members of the trusted forest to use resources that are located in the trusting forest. However, the trust operates in only one direction. For example, when a one-way, forest trust is created between forest A (the trusted forest) and forest B (the trusting forest), members of forest A can access resources that are located in forest B, but members of forest B cannot access resources that are located in forest A, using the same trust. </maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Using two-way, forest trusts</maml:title><maml:introduction>
<maml:para>A two-way, forest trust between two forests allows members from either forest to use resources that are located in the other forest, and domains in each respective forest trust domains in the other forest implicitly. For example, when a two-way, forest trust is established between forest A and forest B, members of forest A can access resources that are located in forest B, and members of forest B can access resources in forest A, using the same trust. </maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Select the Scope of Authentication for Users</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to specify the scope of authentication for users that are authenticating through external trusts or forest trusts.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To select the scope of authentication using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain node for the domain that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, under either <maml:ui>Domains trusted by this domain (outgoing trusts)</maml:ui> or <maml:ui>Domains that trust this domain (incoming trusts)</maml:ui>, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To select the scope of authentication for users that are authenticating through an external trust, click the external trust that you want to administer, and then click <maml:ui>Properties</maml:ui>. On the <maml:ui>Authentication</maml:ui> tab, click either <maml:ui>Domain-wide authentication</maml:ui> or <maml:ui>Selective authentication</maml:ui>.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To select the scope of authentication for users that are authenticating through a forest trust, click the forest trust that you want to administer, and then click <maml:ui>Properties</maml:ui>. On the <maml:ui>Authentication</maml:ui> tab, click either <maml:ui>Forest-wide authentication</maml:ui> or <maml:ui>Selective authentication</maml:ui>.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For an external trust, if you select <maml:ui>Selective authentication</maml:ui>, you must enable permissions manually on the local domain and on the resource to which you want users in the external domain to have access.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>For a forest trust, if you select <maml:ui>Selective authentication</maml:ui>, you must enable permissions manually on each domain and resource in the local forest to which you want users in the second forest to have access.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You can use selective authentication only on external trusts and forest trusts.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Exclude Name Suffixes from Routing to a Local Forest</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to exclude name suffixes from routing to a local forest.</maml:para>
<maml:para>Name suffix routing is a mechanism that you can use to manage how authentication requests are routed across Windows Server 2008 or Windows Server 2008 R2 forests that are joined by forest trusts. To simplify the administration of authentication requests, when you create a forest trust all unique name suffixes are routed by default. A unique name suffix is a name suffix within a forest, such as a user principal name (UPN) suffix, service principal name (SPN) suffix, or Domain Name System (DNS) forest or domain tree name that is not subordinate to any other name suffix.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To exclude name suffixes from routing to a local forest</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain node for the domain that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, under either <maml:ui>Domains trusted by this domain (outgoing trusts)</maml:ui> or <maml:ui>Domains that trust this domain (incoming trusts)</maml:ui>, click the forest trust that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Name Suffix Routing</maml:ui> tab. Under <maml:ui>Name suffixes in the x.x. forest</maml:ui>, click the unique name suffix for which you want to exclude the routing status, and then click <maml:ui>Edit</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In <maml:ui>Name suffixes to exclude from routing to x.x</maml:ui>, click <maml:ui>Add</maml:ui>, type a DNS name suffix that is subordinate to the unique name suffix, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>When you exclude a name suffix, all children of that DNS name will also be excluded.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To view a log of name suffixes, DNS names, NetBIOS names, and the status that is associated with this trust, click <maml:ui>Save As</maml:ui>. This log can assist you in troubleshooting authentication problems.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual>GIF89a && YYBrffL??/33&_̙|iLL9 rrVffooyyƩ̳Ҽyyypppooofff```___PPPOOO@@@???000/// , @IFI Ƹβܦ远
p
"\p#zp,ȰHXyܸYY%IV.PAC*.qU2e} p䃪 P ARANuuku>?( A 8`Htp%d 5Ya߭
7$ Hb 6˘3k̹3fq1p u8qōUEvukOZmHTe2 NnN;ꄰL]pa[40@4P ӫ_Ͼ#X J;{n$f u ^I,W Ar&
&jyEt
[8Uʇ!&0~ 6UDuJ2C )3X#=-E@
YdGB-CQ9<AңܒЖK6}K fjN|! a@v&zI@7]$j$ZϠ
1I* َ'B "
JR/x(<B:#
< +"Cz;zN㜚+,˪vPò,8:,9h l32O18[8r52ϒSO>KफM:,/+&]啀Wlr6't, ؛C&e.LM 1뷬 /^0"h' C:ݖ*9]0U3a;' Rv2p:#,kwP( ; eG6g39AK; iG[67
<0rmW932x.(w .:9wz5 [Bc8`C긔0쯆Pt8 bS mu~}8P- 5H-O˔?1։S}☁P'm85\ z絋ٌ 46A`+p6p'^ E!@ 0 [3,@;`(bp& @ h`;jzᱶ(6= EFp +F(ˏ5:jQ$p(4M,,I|ںr54^
+D"CD#*
1#4 (T (QU((h R<&$0CPy.1ĠZ D .w쀐
0!\{ `d@b|KB8X A_ 1\R/b&<9Ak/"CS17I7 Q<*%TPP
2{t0B Ut
8Tख़Y+wJXӥؓ^<D04,fqoZ
Hcc;,`m.W`X]e+dT `e2NNdʤVpuUF M~א,kF6=խ+" ѹ
A4d;^p8'^W7XUN,%} a.հQ%{' ^Ye95cf~WԸkؒ7/ J تW' i˻\(vW UjRmۡm=Q _u.*!ca, aۊnmO
(1*01 ,ɀr#p萛ς`C x!9+hcYԠw ȪV8J2 ޞ8"{u#ҺN<b$rO, X^bY5 X+
#؏gfWnh_ޗݙ2{bY)*Ύ2sUP`XU \jᗗuGO֜%)W7cAUT@?()*~$Y1HB $@FϪѐ~hN <vɪ8 K'=,<xРE*͌%7 0S"HwtMf`! UJP<2 mFKl%T=N cJ! # )Hw$r)ew
hLyQ#b"4P ܟnA!Q2K)ӏA"m("^ҸpOMDǹuj%BcR2璹"?-CpT`B$B(ԍD"݉q"?t%f: LyWYֻCF)j
)ΰ". ei > p %=4`i+1)[Z/y/[ yϋzdw:t(~m ?;^wFY{G #`2~b`HhxTEA4 ^Gd27\w
G~{z*^+.'4X{0X8H^9că>R?F%D(ExwH1NP*8TzVxZxl\U`H@b8Rf*IІnpr8tH ;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Trust Transitivity</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Trust transitivity</maml:title><maml:introduction>
<maml:para>Transitivity determines whether a trust can be extended outside the two domains between which the trust was formed. You can use a transitive trust to extend trust relationships with other domains. You can use a nontransitive trust to deny trust relationships with other domains. </maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Transitive trust</maml:title><maml:introduction>
<maml:para>Each time that you create a new domain in a forest, a two-way, transitive trust relationship is automatically created between the new domain and its parent domain. If child domains are added to the new domain, the trust path flows upward through the domain hierarchy, extending the initial trust path that is created between the new domain and its parent domain. </maml:para>
<maml:para>Transitive trust relationships flow upward through a domain tree as it is formed, creating transitive trusts between all domains in the domain tree. </maml:para>
<maml:para>Authentication requests follow these trust paths. Therefore, accounts from any domain in the forest can be authenticated at any other domain in the forest. With a single logon process, accounts with the proper permissions can access resources in any domain in the forest. </maml:para>
<maml:para>In addition to the default transitive trusts that are established in a Windows Server 2008 or Windows Server 2008 R2 forest, by using the New Trust Wizard you can manually create the following transitive trusts: </maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:phrase>Shortcut trust</maml:phrase>: A transitive trust between a domain in the same domain tree or forest that shortens the trust path in a large and complex domain tree or forest. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:phrase>Forest trust</maml:phrase>: A transitive trust between a forest root domain and a second forest root domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:phrase>Realm trust</maml:phrase>: A transitive trust between an Active Directory domain and a Kerberos V5 realm. For more information about Kerberos V5 realms, see Kerberos V5 authentication (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92699</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92699"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
</maml:list>
<maml:para>The following illustration shows a two-way, transitive trust relationship between the Domain A tree and the Domain 1 tree. All domains in the Domain A tree and all domains in the Domain 1 tree have transitive trust relationships by default. As a result, users in the Domain A tree can access resources in domains in the Domain 1 tree, and users in the Domain 1 tree can access resources in the Domain A tree when the proper permissions are assigned at the resource. </maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=1f6970c2-62d3-482d-a78a-451d4333f511" mimeType="image/gif"><maml:summary>A two-way, transitive trust path connects domains</maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:para>For more information about trust types, see <maml:navigationLink><maml:linkText>Understanding Trust Types</maml:linkText><maml:uri href="mshelp://windows/?id=6472046a-30dd-4dc9-92e0-450cebdafc90"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Nontransitive trust</maml:title><maml:introduction>
<maml:para>A nontransitive trust is restricted by the two domains in the trust relationship. It does not flow to any other domains in the forest. A nontransitive trust can be a two-way trust or a one-way trust. Nontransitive trusts are one-way by default, although you can also create a two-way relationship by creating two one-way trusts. </maml:para>
<maml:para>In summary, nontransitive domain trusts are the only form of trust relationship that is possible between the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>A Windows Server 2008 or a Windows Server 2008 R2 domain and a Windows NT domain</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>A Windows Server 2008 or a Windows Server 2008 R2 domain in one forest and a domain in another forest (when the forests are not joined by a forest trust)</maml:para>
</maml:listItem>
</maml:list>
<maml:para>You can use the New Trust Wizard to manually create the following nontransitive trusts:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:phrase>External trust</maml:phrase>: A nontransitive trust between a Windows Server 2008 or a Windows Server 2008 R2 domain and a Windows NT domain or a Windows 2000 domain, Windows Server 2003 domain, Windows Server 2008, or a Windows Server 2008 R2 domain in another forest. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:phrase>Realm trust</maml:phrase>: A nontransitive trust between an Active Directory domain and a Kerberos version 5 (V5) realm. For more information about Kerberos V5 realms, see Kerberos V5 authentication (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92699</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92699"></maml:uri></maml:navigationLink>).</maml:para>
</maml:listItem>
</maml:list>
<maml:para>For more information about trust types, see <maml:navigationLink><maml:linkText>Understanding Trust Types</maml:linkText><maml:uri href="mshelp://windows/?id=6472046a-30dd-4dc9-92e0-450cebdafc90"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Create a Forest Trust</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to create trust relationships between domains.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To create a forest trust</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, click <maml:ui>New trust</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trust Name</maml:ui> page, type the Domain Name System (DNS) name (or NetBIOS name) of the domain, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trust Type</maml:ui> page, click <maml:ui>Forest trust</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Direction of Trust</maml:ui> page, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To create a two-way, forest trust, click <maml:ui>Two-way</maml:ui>.</maml:para>
<maml:para>Users in this forest and users in the specified forest will be able to access resources in either forest.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way, incoming forest trust, click <maml:ui>One-way:incoming</maml:ui>.</maml:para>
<maml:para>Users in the specified forest will not be able to access any resources in this forest.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way, outgoing forest trust, click <maml:ui>One-way:outgoing</maml:ui>.</maml:para>
<maml:para>Users in this forest will not be able to access any resources in the specified forest.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Continue to follow the instructions in the wizard.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you have the appropriate administrative credentials for each forest, you can create both sides of a forest trust at the same time by clicking <maml:ui>Both this domain and the specified domain </maml:ui>on the <maml:ui>Sides of Trust</maml:ui> page. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you want users from the specified forest to have access to all computers in the local forest, on the <maml:ui>Outgoing Trust Properties</maml:ui> page, click <maml:ui>Forest-wide authentication</maml:ui>. This option is preferred when both forests belong to the same organization.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you want to selectively limit authentication to particular users and groups from the specified forest, on the <maml:ui>Outgoing Trust Properties</maml:ui> page, click <maml:ui>Selective authentication</maml:ui>. This option is preferred if the specified forest belongs to a separate organization.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>In addition to creating new trusts, you can modify existing trusts by clicking the <maml:ui>Trust</maml:ui> tab.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Checklist: Create a Forest Trust</maml:linkText><maml:uri href="mshelp://windows/?id=230ae7d6-352d-41d6-880d-f02052f6996c"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Create a Realm Trust</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to create realm trusts.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Creating a realm trust</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using the Windows interface</maml:linkText><maml:uri href="mshelp://windows/?id=845f4f62-9231-44f6-ac76-572da9d09321#BKMK_winui"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Using a command line</maml:linkText><maml:uri href="mshelp://windows/?id=845f4f62-9231-44f6-ac76-572da9d09321#BKMK_cmd"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section address="BKMK_winui"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To create a realm trust using the Windows interface</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, click <maml:ui>New trust</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trust Name</maml:ui> page, type the realm name for the target realm, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trust Type</maml:ui> page, select the <maml:ui>Realm trust</maml:ui> option, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Transitivity of Trust</maml:ui> page, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To form a trust relationship with the domain and the specified realm, click <maml:ui>Nontransitive</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To form a trust relationship with the domain and the specified realm and all trusted realms, click <maml:ui>Transitive</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Direction of Trust</maml:ui> page, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To create a two-way, realm trust, click <maml:ui>Two-way</maml:ui>.</maml:para>
<maml:para>Users in this domain and users in the specified realm will be able to access resources in either domain or realm.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way, incoming realm trust, click <maml:ui>One-way:incoming</maml:ui>. </maml:para>
<maml:para>Users in the specified realm will not be able to access any resources in this domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To create a one-way, outgoing realm trust, click <maml:ui>One-way:outgoing</maml:ui>.</maml:para>
<maml:para>Users in this domain will not be able to access any resources in the specified realm.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Continue to follow the instructions in the wizard.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section address="BKMK_cmd"><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To create a realm trust using a command line</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open a command prompt. To open a command prompt, click <maml:ui>Start</maml:ui>, click <maml:ui>Run</maml:ui>, type <maml:userInput>cmd</maml:userInput>, and then click <maml:ui>OK</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Type the following command, and then press ENTER: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d:<TrustedDomainName> /add /realm /PasswordT:<NewRealmTrustPassword></dev:code>
</maml:section></maml:sections></maml:step></maml:procedure>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Parameter</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Description</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>netdom trust</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Manages or verifies trust relationships between domains.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustingDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the Domain Name System (DNS) name of the trusting domain in the new realm trust.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/d:</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that the DNS domain name that follows is a trusted domain.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><TrustedDomainName></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the DNS name of the domain that will be trusted in the new realm trust.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/add</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies that a trust be created.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/realm</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Indicates that the trust is to be created to a non-Windows Kerberos realm.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para>/PasswordT:</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the new trust password. This parameter is valid only if one of the domains specified is a non-Windows Kerberos realm.</maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><NewRealmTrustPassword></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies the trust password for the new realm trust. This password must match the password that is used in the Kerberos realm.</maml:para>
</maml:entry></maml:row>
</maml:table>
<maml:para>To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:</maml:para>
<dev:code>netdom trust | more </dev:code>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support. You can verify shortcut trusts, external trusts, and forest trusts but not realm trusts.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You can use other parameters to assign a password or determine the direction of the trust. For example, to make the previous trust a two-way, transitive trust, use the following syntax: </maml:para>
<dev:code>netdom trust <TrustingDomainName> /d:<TrustedDomainName> /add /realm /twoway</dev:code>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Add User Principal Name Suffixes</maml:title><maml:introduction>
<maml:para>You can use Active Directory Domains and Trusts to add user principal name (UPN) suffixes for the existing user account. The default UPN suffix for a user account is the Domain Name System (DNS) domain name of the domain that contains the user account. You can add alternative UPN suffixes to simplify administration and user logon processes by providing a single UPN suffix for all users. The UPN suffix is used only within the Active Directory forest, and it is not required to be a valid DNS domain name.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To add UPN suffixes</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click <maml:ui>Active Directory Domains and Trusts</maml:ui>, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>UPN Suffixes</maml:ui> tab, type an alternative UPN suffix for the forest, and then click <maml:ui>Add</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Repeat step 3 to add additional alternative UPN suffixes.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>UPN suffixes should conform to DNS conventions for valid characters and syntax.</maml:para>
</maml:listItem>
<maml:listItem><maml:para>You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Module for Windows PowerShell</maml:ui>. For more information, see Add User Principal Name Suffixes (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=137827</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=137827"></maml:uri></maml:navigationLink>). For more information about Windows PowerShell, see Windows PowerShell (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkID=102372</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=102372"></maml:uri></maml:navigationLink>).
</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Domains and Forests</maml:linkText><maml:uri href="mshelp://windows/?id=ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Raise the Forest Functional Level</maml:title><maml:introduction>
<maml:para>When you install Active Directory Domain Services (AD DS) on a server running Windows Server 2008 R2, a set of basic Active Directory features is enabled by default. In addition to the basic Active Directory features on individual domain controllers, there are new domain-wide and forest-wide Active Directory features available when all domain controllers in a domain or forest are running Windows Server 2008 R2.</maml:para>
<maml:para>To enable new forest-wide features, all domain controllers in the forest must be running Windows Server 2008 R2, and the forest functional level must be raised to Windows Server 2008 R2.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To raise the forest functional level</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click <maml:ui>Active Directory Domains and Trusts</maml:ui>, and then click <maml:ui>Raise Forest Functional Level</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In <maml:ui>Select an available forest functional level</maml:ui>, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To raise the forest functional level to Windows Server 2008, click <maml:ui>Windows Server 2008</maml:ui>, and then click <maml:ui>Raise</maml:ui>.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To raise the forest functional level to Windows Server 2008 R2, click <maml:ui>Windows Server 2008 R2</maml:ui>, and then click <maml:ui>Raise</maml:ui>.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
<maml:alertSet class="caution"><maml:title>Caution </maml:title>
<maml:para>Do not raise the forest functional level to Windows Server 2008 R2 if you have or will have any domain controllers running Windows Server 2008 or earlier. </maml:para>
</maml:alertSet>
<maml:alertSet class="important"><maml:title>Important </maml:title>
<maml:para>After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
</maml:para>
</maml:alertSet>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Windows Server 2003 is the minimum domain functional level required for raising the forest functional level to Windows Server 2008. Likewise, Windows Server 2008 is the minimum domain functional level required for raising the forest functional level to Windows Server 2008 R2. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Before you raise the forest functional level to Windows Server 2008 R2, verify that all domains in the forest are set to the domain functional level of Windows Server 2008. Note that domains that are set to the domain functional level of Windows Server 2008 will automatically be raised to Windows Server 2008 R2 at the same time that the forest functional level is raised to Windows Server 2008 R2.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>If you are not able to raise the forest functional level, you can click <maml:ui>Save As</maml:ui> in the <maml:ui>Raise Forest Functional Level</maml:ui> dialog box to save a log file that specifies which domain controllers in the forest still need to be upgraded to a later version.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>The current forest functional level is displayed under <maml:ui>Current forest functional level</maml:ui> in the <maml:ui>Raise Forest Functional Level</maml:ui> dialog box.</maml:para>
</maml:listItem>
<maml:listItem><maml:para>You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Module for Windows PowerShell</maml:ui>. For more information, see Raise the Forest Functional Level (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=137826</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=137826"></maml:uri></maml:navigationLink>). For more information about Windows PowerShell, see Windows PowerShell (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkID=102372</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=102372"></maml:uri></maml:navigationLink>).
</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Domains and Forests</maml:linkText><maml:uri href="mshelp://windows/?id=ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding When to Create a Realm Trust</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>When to create a realm trust</maml:title><maml:introduction>
<maml:para>You can establish a realm trust between any non-Windows Kerberos version 5 (V5) realm and a Windows Server 2008 or a Windows Server 2008 R2 domain. This trust relationship allows cross-platform interoperability with security services that are based on other versions of the Kerberos V5 protocol, for example, UNIX and MIT implementations. Realm trusts can switch from nontransitive to transitive and back. Realm trusts can also be either one-way or two-way. </maml:para>
<maml:para>For information about how to create a realm trust, see <maml:navigationLink><maml:linkText>Create a Realm Trust</maml:linkText><maml:uri href="mshelp://windows/?id=845f4f62-9231-44f6-ac76-572da9d09321"></maml:uri></maml:navigationLink>. </maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual>GIF89a ̙f̙̙ff , X0I8ͻ`(dihlp,t
v|`,- rT
ͨtRXʓzw[w<
s4*nV|~5}kd"qe[G
{y.)} rw©UmʱԟՈMWoKF2o $B
a>bad ?xQdM2BR.i,L53l3N= Dj'
J=>uj<u*ץZ+r
+T[͢ufZm mv =@$ ^|_^`3]Ǐ9d yAd: mqQf9b X ul?m{6H%EfظS{ƽ\9sO/
atʝ A0Kl[ԡ_sz[^x
,euAZoiu~ƞ `s^ {a z nȑ~LA_i( }!
f+Xcy7dbQ&FN;cq?r0$~ IdW Y>2 'CeR6pJW.]eRI&4fbY)&ftqFgDztFcz&/Z" EEgЩYN R>J©:XDi kjJ (.QXZ <{#Fʹ2+؎RA]B>®EKͻf /. AxW!Ry BJ-l Q8̆ 2Tgl2&gL ubUs(,X*'2 <sO?&E|(Dg/[t,TX:sMuH\pǭ|`3%w9PY( @br'-6&y=0xԖ8/.w < u w>|9ƂD/ָ*N~:{ ӷۮԹ?ͯ,r[LFei =22so?~&^ԷE}K=rQ9pkk
9 4X@M_) e%$'^OKh`
pz_Q :Sa" FYP/% cgS"1 &[ Rt-fzaQEXp@)pXӝw; Ovp*Bmx2zHH1ZφPDc#ȏ)ddI(Lp0
'FNL%LTfr~;`pgJ>'T.sZfcR`H.y2eJƤ7Kn@ M
ꯕ w>Qs&Hvj v6U);a(<&Te td4S>Hӟgv>M.G(jpeCUL}&EofT3XR !$BPt)<On@l),NrSzJ:P%
nd8)̷],n`A1S D=Ԅ*@ 2
E &ORuHV:C'DvMA}Z cU4,b6"W6Ӝ5ы V5ijz 泭
hԨt',P!ӟ(8 &"+e3v?l_Zzm9-xw6 xEŮG;4*_us=WH\n;ji%`u;oz!-; JnDC ]I
/d
X` &Z SeK) DF&n]Z 7
Ȣ=nkEo4w 8t0Gxb [ j2dg;[ d Jג{<^9so^~ݼ=:)9oT3 K V:6`.4<,iA;t ,zZ}gWPۨ]jՙ|Z`BY,@B hfs8nw۲p EMy v$oH*op$؍Q0#jHLh'N9]Mt Ý|;N* ɽRyL7µ6r\W0ıl:o Ǹ
sѵ%cY$xO /cŝqܚINP ~.Uɘa"~(Uz$gJv b'ΖiCֽ젹Z&wݭdd%aѯxoL~n)b!4 ř²g l=Y|MdarI'mM}>o$:˿[AS#e1Ü$7a @qM|mT}+Ewu~~vܷ]5 iՋ%j?(ttVk5L5gp4pUavJXGm4yh23
=ǀh|wH{u&W_vR XyG\&nD!0 HWk1BK;hLäxA1m!~fD'Hyw3qQt1| F4;$Pf{G8hP2:x4y(Y4QWrt|v<AAwihGA!@16=:N"mCJ;&c2[HJi5Ԇ&%w%$S(FlCa1*0&@H:3hQz6"9 0ԍH8$/^6R18`0vɎVi@9
2e)rb[ב
2ڂD&I%$Ē!294Y6y8:<ٓ>X X1 ?dLD9 0U"ZI hX
rOɔ WY`X9b6*TXᥕZj9Z, "reVZud .ZPFqd d|Y^ `\ 'Y!EE!o"]% Y^_^`Xa)bb bZG Yd{9# ŕ0јI^ei`bY+(FŅ9 " ƹQ! fbII#ٜ~yoydwaYM֗(&#YiYF9L Z
j ڡ9 pWP&UG0,:y5Z/:W%e_yr7ɞ4 JJYM* C:?¤O D%d\ڥq92tIgjnʣp`l:z|ڧ~t ;GIF89a 3 f 3 33 3f 3 3 3 f f3 ff f f f 3 f 3 f ̙ 3 f 3 3 33 f3 3 3 33 33333f3333333f 3f33ff3f3f3f3 333f3333 333f3̙333 333f333f f 3f ff f f f3 f33f3ff3f3f3ff ff3ffffffffff f3ffffff f3fff̙fff f3fffff 3 f ̙ 3 333f33̙3f f3ffff̙f 3f̙ 3f̙̙ 3f̙ 3 f 3 333f333f f3fffff̙ ̙3̙f̙̙̙ 3f̙ 3f 3 f 3 333f333f f3fffff 3f 3f̙ 3f ! , H*\ȰÇ#J,`ŋ3j( C IҡG%S\㪏,cʜy%L8sΟ@'QC{ ]ZҗDJT)PSV"]i~:rU> KY ;lEu: Hm#=bǺ5xnMŁ-_ċ3{2fN&lc͟Sj7Pcsco.m۵Iew+Wi͜wQK :G=ܻ]<v7G<zӿ ߗ |hAVX4 J8!Y i!y!؉8"͉bw Ȣ.81Gc/^c'ۍ>cIdC IJ.dR1 e >9eP-^TZeb^~ f\ fUfgJɦNn KGgJ'yUtzEY3d'
5( JO sQ5Y$Esb`1Wk}9e _ziueiDžpR\)BH^{tmVny]`|"Z_G{g`|k 滳+/{/;%
(Y qFqNf ,:P&Cc rDVrC2ϬP6'ssA>,PBG(q-<3t%#RrVS]4QW-&S_
bM^uf-qpwۂm( ݨVz+jg
,jk]n1N밺F{X8;Xsj,j;n+̂n;bK;;~-'6,"k|O0e
cf=sh3T@ ;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Trusts</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Trusts</maml:title><maml:introduction>
<maml:para>A trust is a relationship, which you establish between domains, that makes it possible for users in one domain to be authenticated by a domain controller in the other domain. </maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Trusts in Windows NT</maml:title><maml:introduction>
<maml:para>In the Windows NT 4.0 operating system, trusts are limited to two domains, and the trust relationship is nontransitive and one-way. In the following illustration, the nontransitive, one-way trust is shown by the straight arrow pointing to the trusted domain. </maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=218c5e4d-e17e-4dce-8fa8-d37ff02fe8bb" mimeType="image/gif"><maml:summary>Direction of trust path</maml:summary></maml:objectUri></maml:embedObject></maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Trusts in Windows 2000 Server, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 operating systems</maml:title><maml:introduction>
<maml:para>All trusts in Windows 2000 Server, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 forests are transitive, two-way trusts. Therefore, both domains in a trust relationship are trusted. As shown in the following illustration, this means that if Domain A trusts Domain B and Domain B trusts Domain C, users from Domain C can access resources in Domain A (when they are assigned the proper permissions). Only members of the Domain Admins group can manage trust relationships.</maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=938e20ba-8457-4f6c-83a0-e428a15c3e70" mimeType="image/gif"><maml:summary>Transitive trusts in a domain tree</maml:summary></maml:objectUri></maml:embedObject></maml:para>
</maml:introduction></maml:section><maml:section address="H2_53862376">
<maml:title>Trust protocols</maml:title><maml:introduction>
<maml:para>A domain controller running Windows Server 2008 or Windows Server 2008 R2 authenticates users and applications using one of two protocols: the Kerberos version 5 (V5) protocol or NTLM. The Kerberos V5 protocol is the default protocol for computers running Windows 2000, Windows XP Professional, Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2. If any computer in a transaction does not support the Kerberos V5 protocol, the NTLM protocol is used.</maml:para>
<maml:para>With the Kerberos V5 protocol, the client requests a ticket from a domain controller in its account domain to the server in the trusting domain. This ticket is issued by an intermediary that is trusted by the client and the server. The client presents this trusted ticket to the server in the trusting domain for authentication. For more information, see Kerberos V5 authentication (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=81795</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=81795"></maml:uri></maml:navigationLink>).</maml:para>
<maml:para>When a client tries to access resources on a server in another domain using NTLM authentication, the server that contains the resource must contact a domain controller in the client account domain to verify the account credentials.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Trusted domain objects</maml:title><maml:introduction>
<maml:para>Trusted domain objects (TDOs) are objects that represent each trust relationship within a particular domain. Each time that a trust is established, a unique TDO is created and stored in its domain (in the System container). Attributes such as trust transitivity, type, and the reciprocal domain names are represented in the TDO.</maml:para>
<maml:para>Forest trust TDOs store additional attributes to identify all the trusted namespaces from its partner forest. These attributes include domain tree names, user principal name (UPN) suffixes, service principal name (SPN) suffixes, and security identifier (SID) namespaces.</maml:para>
<maml:para>For more information about domain trusts, see Trust Technologies (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92695</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92695"></maml:uri></maml:navigationLink>). For more information about trust relationships, see Designing a Resource Authorization Strategy (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92696</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92696"></maml:uri></maml:navigationLink>). </maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Trust Direction</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>Trust direction</maml:title><maml:introduction>
<maml:para>The trust type and its assigned direction affect the trust path that is used for authentication. A trust path is a series of trust relationships that authentication requests must follow between domains. Before a user can access a resource in another domain, the security system on domain controllers running Windows Server 2008 or Windows Server 2008 R2 must determine whether the trusting domain (the domain that contains the resource that the user is trying to access) has a trust relationship with the trusted domain (the user's logon domain). To determine this, the security system computes the trust path between a domain controller in the trusting domain and a domain controller in the trusted domain. In the following illustration, the trust path is indicated by an arrow that shows the direction of the trust. </maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=218c5e4d-e17e-4dce-8fa8-d37ff02fe8bb" mimeType="image/gif"><maml:summary>Direction of trust path</maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:para>All domain trust relationships have only two domains in the relationship: the trusting domain and the trusted domain. </maml:para>
</maml:introduction></maml:section><maml:section address="H2_53855779">
<maml:title>One-way trust</maml:title><maml:introduction>
<maml:para>A one-way trust is a unidirectional authentication path that is created between two domains. This means that in a one-way trust between Domain A and Domain B, users in Domain A can access resources in Domain B. However, users in Domain B cannot access resources in Domain A. Some one-way trusts can be either a nontransitive trust or a transitive trust, depending on the type of trust that is created. For more information about trust types, see <maml:navigationLink><maml:linkText>Understanding Trust Types</maml:linkText><maml:uri href="mshelp://windows/?id=6472046a-30dd-4dc9-92e0-450cebdafc90"></maml:uri></maml:navigationLink>. </maml:para>
</maml:introduction></maml:section><maml:section address="H2_53856945">
<maml:title>Two-way trust</maml:title><maml:introduction>
<maml:para>All domain trusts in a Windows Server 2008 or a Windows Server 2008 R2 forest are two-way, transitive trusts. When a new child domain is created, a two-way, transitive trust is automatically created between the new child domain and the parent domain. In a two-way trust, Domain A trusts Domain B and Domain B trusts Domain A. This means that authentication requests can be passed between the two domains in both directions. Some two-way relationships can be either nontransitive or transitive, depending on the type of trust that is created. For more information, see <maml:navigationLink><maml:linkText>Understanding Trust Types</maml:linkText><maml:uri href="mshelp://windows/?id=6472046a-30dd-4dc9-92e0-450cebdafc90"></maml:uri></maml:navigationLink>. </maml:para>
<maml:para>A Windows Server 2008 or a Windows Server 2008 R2 domain can establish one-way or two-way trusts with the following domains and realms:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>Windows Server 2008 or Windows Server 2008 R2 domains in the same forest</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Windows Server 2008 or Windows Server 2008 R2 domains in a different forest</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Windows Server 2003 domains in the same forest</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Windows Server 2003 domains in a different forest</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Windows NT 4.0 domains</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>Kerberos version 5 (V5) realms</maml:para>
</maml:listItem>
</maml:list>
<maml:para>For more information about the Kerberos V5 protocol, see Kerberos V5 authentication (<maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=92699</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=92699"></maml:uri></maml:navigationLink>).</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Enable or Disable an Existing Name Suffix from Routing</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to modify the routing of the existing name suffixes.</maml:para>
<maml:para>Name suffix routing is a mechanism that you can use to manage how authentication requests are routed across Windows Server 2008 or Windows Server 2008 R2 forests that are joined by forest trusts. To simplify the administration of authentication requests, when you create a forest trust all unique name suffixes are routed by default. A unique name suffix is a name suffix within a forest, such as a user principal name (UPN) suffix, service principal name (SPN) suffix, or Domain Name System (DNS) forest or domain tree name that is not subordinate to any other name suffix.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To enable or disable an existing name suffix from routing</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain node for the domain that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, under either <maml:ui>Domains trusted by this domain (outgoing trusts)</maml:ui> or <maml:ui>Domains that trust this domain (incoming trusts)</maml:ui>, click the forest trust that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Click the <maml:ui>Name Suffix Routing</maml:ui> tab, and under <maml:ui>Name suffixes in the x.x. forest</maml:ui>, do one of the following:</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To enable a name suffix, click the suffix that you want to enable, and then click <maml:ui>Enable</maml:ui>. If the <maml:ui>Enable</maml:ui> button appears dimmed, the name suffix is already enabled.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To disable a name suffix, click the suffix that you want to disable, and then click <maml:ui>Disable</maml:ui>. If the <maml:ui>Disable</maml:ui> button appears dimmed, the name suffix is already disabled.</maml:para>
</maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>When you disable a name suffix, all children of that DNS name will also be disabled.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You cannot enable a name suffix that is in conflict. If the conflict is with a local UPN name suffix, you must remove the local UPN name suffix before you can enable the routing name. If the conflict is with a name that is claimed by another trust partner, you must disable the name in the other trust before it can be enabled for this trust.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Change Forest Dialog Box</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Item</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Details</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Root domain</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Displays the fully qualified domain name (FQDN) of the forest root domain that is the current focus of the Active Directory Domains and Trusts snap-in. To change the focus of the snap-in to another forest root domain, type the full Domain Name System (DNS) name of the other forest root domain here. </maml:para>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Save this domain setting for the current console</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Specifies whether to save the current domain focus for the given snap-in. If you select this option, the next time that you open the snap-in, it will focus on the domain that is listed here.</maml:para>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual>GIF89a ̙̙fffff , 0ʩ 7ͻ`(diӠBl|rkMk|GЊA cZ9jhKZج6t]ocznY- ^TyNi2vceqw%KP{^}bryM8 ~)5]H+f {CTf6lǣϚQqM|p
H{YȰÇ#JHŋ3jȱ C8ɓ(S\ɲ˗0cʜI͛8sܹr @
`ѣH*]ʴKNJsիXj
uסE K,ٮf ۷pg-ݻx7ݾ 6w+^̲0㫈 K 1e/k穙? m2iUO^4띡_˞M5mo3oع m{Ɠ.\e73n9댧_`Թ{ |t %͚> '`T)*U`r& X!|V!Q աz hbc#W,q+(4
g!H r< (dDf&ےL&mPF9UieXΦuY &b%y}yfSlL 'vD ԟ)@I
YYW+9c"j$T硐{.磗R*t jLvW5*s*gA%1
lul:lJU.: Vkf^Ҳ&ZZnuknαۘ1u+m̪T//^j 컹sVBn*L{S\ 1L +d[*|lp. ̀ 6J@sU0.pƆ%t>WGu)S <IWm?5Lzk^Nmtvo67}]]vڀC-eǬtPGun.潖ՠ?&zON6:㟓z˾z~~ {[eZrEC<fV}WF/UF. K\ Xх7AuXe' TT9\Rf*dp/|g2PM54++BLgI!U,`eXX,EI (d5wm-lDk tDl%3l
Oس&qB<7/$~QWbiMY*դHBr&hG=u+# 5EYVT&KI8gDd(=uW$rJUҐH@l".5!Yq\I+[Ҙ{e&EiHZЖge3̜Lp*dd42Xz3t&Yٯ/fҩͳ蒇B,5A"?D= ʫSۤ?u= tH>rP4CBШ<㹨\ s2 g@ROqE5RR(`ZRԥM)fN*Br,TT=<H`DwjIL=5Q4ګ9ٻjpg=m'ʞQt I&q-zgqkxZU
fYM2f| BF~,SZP~Ӎ,4+|%f5EͶ<H]&ce+\\mR- 1q[N5}}'y:kun,"{߂ #kjMDj;A_)FE<bp+oR
HJSL{M >py2\e+ G2&XzZX'$Ζt{F1Y[#ҷRcU5cK
6qKC`.?͓QTșr<c5SvՐ`ZXΗkf;F<4MUg-o p:g pτMtfZzSie¿H~Y' =EKz4:DԜk2?3iZ1PmF^m;U&8Nbͳ4˥4FQLƑ-WNGꐎ>"f@]@;%.q,~={. U['{D
=)z"o"9Yoj5xok6) n, -}.ww4t/ܚf87j4ӵM\v\@7
9GVJ{jh?'d;T8rV#tOAvG'3 STh:GE
ƹK6]9 K+~g/w1_(?{vEZq|~Nr3ΛH~n-8OF^:U I;^3ה}[t᪹ZUx\R OSG knOT:X>Mw + " ޏv
1%$7~~'&" P9[ GZ":x'K6$l
H
h`&Հ0Bh\b@/6 7x(GPehT"35'DH Ixkd"NUhф&EH GTVȄvL HajNH#hȅf| !8߳>j҃o*X#|؇)88Cgt2WT ^'Ȁb8co"V%dxj&4qzx1n*rA(fv,7r4uoW82"pa2_:utuUdsJlXv8\Te` bZO፼Zhxq6a74%Guݤxd-7oX t('P?H(hx6uz}ƨ?!yd&iܕ28F+xiؓ"FHؔh?"ArhEXZ, {_i aT\$^Yfq.2lInY pY}s u,wr_җ{!zhCiZ9 Oy g9IK9QX蓨I ٚ ) t͑Qɛᛶ !EIařUۡ9(ιl#ڹٝ A(Y v@(ٞ)9yY
ٟ'9z:P :
ڠZJ
ڡʡ "ZI @ &(,0:X4zi8aZ< @: 9@HL
KڤPsQZ0VbZڥPdTb
`:f
vvj
ȳnrJq:vqz|ڧ~:Zz
L Ꟑڨ *OШj
Z PjP
ګ8ૻj z*@zԊ
J ZؚǪͪj
ƚЫz b0
9`[{
Z Kdʯ[Lzڮ ˭՚
% 0-z3[)K ;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding When to Create an External Trust</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section>
<maml:title>When to create an external trust</maml:title><maml:introduction>
<maml:para>You can create an external trust to form a one-way or two-way, nontransitive trust with domains that are outside your forest. External trusts are sometimes necessary when users need access to resources in a Windows NT 4.0 domain or in a domain that is located in a separate forest that is not joined by a forest trust, as shown in the following illustration.</maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=722538bd-6535-4406-8c6c-c1e5170c4063" mimeType="image/gif"><maml:summary>External trusts</maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:para>When you establish a trust between a domain in a particular forest and a domain outside that forest, security principals from the external domain can access resources in the internal domain. Active Directory Domain Services (AD DS) creates a foreign security principal object in the internal domain to represent each security principal from the trusted external domain. These foreign security principals can become members of domain local groups in the internal domain. Domain local groups can have members from domains outside the forest.</maml:para>
<maml:para>Directory objects for foreign security principals are created by AD DS, and they should not be modified manually. You can view foreign security principal objects in the Active Directory Users and Computers snap-in by enabling advanced features. (On the <maml:ui>View</maml:ui> menu, click <maml:ui>Advanced Features.</maml:ui>) </maml:para>
<maml:para>For more information about how to create an external trust, see <maml:navigationLink><maml:linkText>Create an External Trust</maml:linkText><maml:uri href="mshelp://windows/?id=72bf4a7d-660e-489f-b475-bea95e8d126c"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Change the Routing Status of a Name Suffix</maml:title><maml:introduction>
<maml:para>You can use the Active Directory Domains and Trusts snap-in to view and modify the routing status of name suffixes.</maml:para>
<maml:para>Name suffix routing is a mechanism that you can use to manage how authentication requests are routed across Windows Server 2008 or Windows Server 2008 R2 forests that are joined by forest trusts. To simplify the administration of authentication requests, when you create a forest trust all unique name suffixes are routed by default. A unique name suffix is a name suffix within a forest, such as a user principal name (UPN) suffix, service principal name (SPN) suffix, or Domain Name System (DNS) forest or domain tree name, that is not subordinate to any other name suffix.</maml:para>
<maml:para>Membership in <maml:phrase>Domain Admins</maml:phrase> or <maml:phrase>Enterprise Admins</maml:phrase>, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at <maml:navigationLink><maml:linkText>http://go.microsoft.com/fwlink/?LinkId=83477</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkId=83477"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title></maml:title><maml:introduction>
<maml:procedure><maml:title>To change the routing status of a name suffix</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Active Directory Domains and Trusts</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In the console tree, right-click the domain node for the domain that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Trusts</maml:ui> tab, under either <maml:ui>Domains trusted by this domain (outgoing trusts)</maml:ui> or <maml:ui>Domains that trust this domain (incoming trusts)</maml:ui>, click the forest trust that you want to administer, and then click <maml:ui>Properties</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>On the <maml:ui>Name Suffix Routing</maml:ui> tab, under <maml:ui>Name suffixes in the x.x forest</maml:ui>, click the suffix for which you want to modify the routing status, and then click <maml:ui>Edit</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title>
<maml:para>In <maml:ui>Existing name suffixes in x.x</maml:ui>, click the suffix that you want to modify, and then click <maml:ui>Enable</maml:ui> or <maml:ui>Disable</maml:ui>.</maml:para>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction>
<maml:sections>
<maml:section><maml:title></maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Additional considerations</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para>To perform this procedure, you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using <maml:ui>Run as</maml:ui> to perform this procedure. For more information, search for "using run as" in Help and Support.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>You cannot enable a name suffix that is in conflict. If the conflict is with a local UPN name suffix, you must remove the local UPN name suffix before you can enable the routing name. If the conflict is with a name that is claimed by another trust partner, you must disable the name in the other trust before it can be enabled for this trust.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para>To view a log of name suffixes, DNS names, NetBIOS names, and the status that is associated with this trust, click <maml:ui>Save As</maml:ui>. This log can assist you in troubleshooting authentication problems.</maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
<maml:section>
<maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Managing Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Domain Properties - Trusts Tab</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para>Item</maml:para>
</maml:entry>
<maml:entry>
<maml:para>Details</maml:para>
</maml:entry></maml:row>
</maml:tableHeader>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Domains trusted by this domain (outgoing trusts)</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:ui>Domain Name</maml:ui>: Lists all the domains that are trusted by the selected domain. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Trust Type</maml:ui>: Specifies the type of trust between the selected domain and the domain that it trusts. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Transitive</maml:ui>: Specifies whether the trust between the selected domain and the domain it trusts is transitive. </maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Properties</maml:ui>: Click to view the properties of the selected trusted domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Remove</maml:ui>: Click to remove the selected trusted domain name from the list of trusted domains.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>Domains that trust this domain (incoming trusts)</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:ui>Domain Name</maml:ui>: Lists all the domains that trust the selected domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Trust Type</maml:ui>: Specifies the type of trust between the selected domain and the domain that trusts it.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Transitive</maml:ui>: Specifies whether the trust between the selected domain and the domain that trusts it is transitive.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Properties</maml:ui>: Click to view the properties of the domain that trusts the selected domain.</maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:ui>Remove</maml:ui>: Click to remove the domain name from the list of domains that trust the selected domain.</maml:para>
</maml:listItem>
</maml:list>
</maml:entry></maml:row>
<maml:row>
<maml:entry>
<maml:para><maml:ui>New Trust</maml:ui></maml:para>
</maml:entry>
<maml:entry>
<maml:para>Click to start the New Trust Wizard.</maml:para>
</maml:entry></maml:row>
</maml:table>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Active Directory Domains and Trusts</maml:linkText><maml:uri href="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Managing Forest Trusts</maml:title><maml:introduction>
<maml:para>You can use Active Directory Domains and Trusts to administer forest trusts.</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding When to Create a Forest Trust</maml:linkText><maml:uri href="mshelp://windows/?id=79feb454-7529-4742-9f39-5d6c0696e6c1"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Checklist: Create a Forest Trust</maml:linkText><maml:uri href="mshelp://windows/?id=230ae7d6-352d-41d6-880d-f02052f6996c"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Create a Forest Trust</maml:linkText><maml:uri href="mshelp://windows/?id=828a249f-9fd5-405f-9cd7-0657de4065a4"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Change the Routing Status of a Name Suffix</maml:linkText><maml:uri href="mshelp://windows/?id=e1d983b5-7817-4972-b6fa-28c3f8577e69"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Enable or Disable an Existing Name Suffix from Routing</maml:linkText><maml:uri href="mshelp://windows/?id=aae18246-025a-44ff-84a5-fccabd63038f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Exclude Name Suffixes from Routing to a Local Forest</maml:linkText><maml:uri href="mshelp://windows/?id=80304139-ee6b-43f0-bc4f-6a4196392d4d"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Managing Domains and Forests</maml:title><maml:introduction>
<maml:para>You can use Active Directory Domains and Trusts to view and manage domain and forest functional levels and create user principal name (UPN) suffixes.</maml:para>
<maml:list class="unordered">
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Understanding Domain and Forest Functionality</maml:linkText><maml:uri href="mshelp://windows/?id=6e36265c-863a-4f03-92b9-ee994e61b34f"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Raise the Domain Functional Level</maml:linkText><maml:uri href="mshelp://windows/?id=0b564360-4440-4dfb-bcda-a3f20406de88"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Raise the Forest Functional Level</maml:linkText><maml:uri href="mshelp://windows/?id=991d570b-7d58-42bb-ad11-12045ebe1ec5"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
<maml:listItem>
<maml:para><maml:navigationLink><maml:linkText>Add User Principal Name Suffixes</maml:linkText><maml:uri href="mshelp://windows/?id=8c0cd186-a239-454b-9789-cef187236918"></maml:uri></maml:navigationLink></maml:para>
</maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><?xml version="1.0" encoding="utf-8"?>
<HelpCollection Id="domadmin" DTDVersion="1.0" FileVersion="" LangId="1033" Copyright="© 2005 Microsoft Corporation. All rights reserved." Title="Active Directory Domains and Trusts" xmlns="http://schemas.microsoft.com/help/collection/2004/11">
<CompilerOptions CompileResult="H1S" CreateFullTextIndex="Yes" BreakerId="Microsoft.NLG.en.WordBreaker">
<IncludeFile File="domadmin.H1F" />
</CompilerOptions>
<TOCDef File="domadmin.H1T" Id="domadmin_TOC" />
<VTopicDef File="domadmin.H1V" />
<KeywordIndexDef File="domadmin_AssetId.H1K" />
<KeywordIndexDef File="domadmin_BestBet.H1K" />
<KeywordIndexDef File="domadmin_LinkTerm.H1K" />
<KeywordIndexDef File="domadmin_SubjectTerm.H1K" />
<ItemMoniker Name="!DefaultTOC" ProgId="HxDs.HxHierarchy" InitData="AnyString" />
<ItemMoniker Name="!DefaultFullTextSearch" ProgId="HxDs.HxFullTextSearch" InitData="AnyString" />
<ItemMoniker Name="!DefaultAssetIdIndex" ProgId="HxDs.HxIndex" InitData="AssetId" />
<ItemMoniker Name="!DefaultBestBetIndex" ProgId="HxDs.HxIndex" InitData="BestBet" />
<ItemMoniker Name="!DefaultAssociativeIndex" ProgId="HxDs.HxIndex" InitData="LinkTerm" />
<ItemMoniker Name="!DefaultKeywordIndex" ProgId="HxDs.HxIndex" InitData="SubjectTerm" />
</HelpCollection><?xml version="1.0" encoding="utf-8"?>
<HelpFileList xmlns="http://schemas.microsoft.com/help/filelist/2004/11">
<File Url="assets\0011ec45-8051-41b2-b8ef-30b9161d3223.xml" />
<File Url="assets\01e41315-a9b3-4f64-95db-f7147bcf1adf.xml" />
<File Url="assets\04c5a443-d7b3-4cc1-932f-c720a8e9cb41.xml" />
<File Url="assets\0b564360-4440-4dfb-bcda-a3f20406de88.xml" />
<File Url="assets\0c97d612-762b-4bba-a158-036c1497446c.xml" />
<File Url="assets\14b8a443-1d98-45a6-b3fa-74b80fc44519.xml" />
<File Url="assets\230ae7d6-352d-41d6-880d-f02052f6996c.xml" />
<File Url="assets\2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b.xml" />
<File Url="assets\2e8f3ff1-225c-46e4-9061-e758df8befa4.xml" />
<File Url="assets\36b61c6d-d4b8-4e1e-bd78-db8204285408.xml" />
<File Url="assets\471131f7-9aa2-4f3b-ad0b-03caf9a9ea07.xml" />
<File Url="assets\5378c53f-ef40-4cdd-96a6-911ba6056083.xml" />
<File Url="assets\574bd0d8-1816-4d1e-bb78-61ffbd84ee34.xml" />
<File Url="assets\6472046a-30dd-4dc9-92e0-450cebdafc90.xml" />
<File Url="relatedAssets\46681e5b-fb4c-45bf-a19b-990ded5bc71b.gif" />
<File Url="assets\6d35ab81-0b60-4425-8c95-46f676d1ea69.xml" />
<File Url="assets\6e36265c-863a-4f03-92b9-ee994e61b34f.xml" />
<File Url="assets\7296dc81-0672-4023-9937-c060fd7eef2f.xml" />
<File Url="assets\72bf4a7d-660e-489f-b475-bea95e8d126c.xml" />
<File Url="assets\791d01b9-2b81-446f-a4ae-75a5a1241a7e.xml" />
<File Url="assets\79feb454-7529-4742-9f39-5d6c0696e6c1.xml" />
<File Url="assets\7a01372b-6eb1-4175-b9ff-8c330a616021.xml" />
<File Url="assets\80304139-ee6b-43f0-bc4f-6a4196392d4d.xml" />
<File Url="relatedAssets\1f6970c2-62d3-482d-a78a-451d4333f511.gif" />
<File Url="assets\80ae74bb-ccdd-4448-91f3-0038de553d9d.xml" />
<File Url="assets\828a249f-9fd5-405f-9cd7-0657de4065a4.xml" />
<File Url="assets\845f4f62-9231-44f6-ac76-572da9d09321.xml" />
<File Url="assets\8c0cd186-a239-454b-9789-cef187236918.xml" />
<File Url="assets\991d570b-7d58-42bb-ad11-12045ebe1ec5.xml" />
<File Url="assets\9e88fe6b-2c8c-4c1a-bc78-21e807eecbba.xml" />
<File Url="relatedAssets\218c5e4d-e17e-4dce-8fa8-d37ff02fe8bb.gif" />
<File Url="relatedAssets\938e20ba-8457-4f6c-83a0-e428a15c3e70.gif" />
<File Url="assets\9ef8c5ac-341e-4473-963b-32b67ff58c29.xml" />
<File Url="assets\a43bb3e4-77b3-4b2e-adbd-d154b346781a.xml" />
<File Url="assets\aae18246-025a-44ff-84a5-fccabd63038f.xml" />
<File Url="assets\c88ba049-2635-4cc8-8f00-76cbeefe18b8.xml" />
<File Url="relatedAssets\722538bd-6535-4406-8c6c-c1e5170c4063.gif" />
<File Url="assets\d50bbb29-2ae1-4d47-bdb3-dc47efc111cf.xml" />
<File Url="assets\e1d983b5-7817-4972-b6fa-28c3f8577e69.xml" />
<File Url="assets\e1ed9885-3d41-4ef4-999a-bfa40d54808e.xml" />
<File Url="assets\fb14e09d-f63b-4341-a8cf-0cad098888c4.xml" />
<File Url="assets\ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1.xml" />
</HelpFileList><?xml version="1.0" encoding="utf-8"?>
<VTopicSet DTDVersion="1.0" xmlns="http://schemas.microsoft.com/help/vtopic/2004/11">
<Vtopic Url="assets\0011ec45-8051-41b2-b8ef-30b9161d3223.xml" RLTitle="Troubleshooting Active Directory Domains and Trusts">
<Attr Name="assetid" Value="0011ec45-8051-41b2-b8ef-30b9161d3223" />
<Keyword Index="AssetId" Term="0011ec45-8051-41b2-b8ef-30b9161d3223" />
<Keyword Index="AssetId" Term="0011ec45-8051-41b2-b8ef-30b9161d32231033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="0011ec45-8051-41b2-b8ef-30b9161d3223" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\01e41315-a9b3-4f64-95db-f7147bcf1adf.xml" RLTitle="Active Directory Domains and Trusts">
<Attr Name="assetid" Value="01e41315-a9b3-4f64-95db-f7147bcf1adf" />
<Keyword Index="AssetId" Term="01e41315-a9b3-4f64-95db-f7147bcf1adf" />
<Keyword Index="AssetId" Term="01e41315-a9b3-4f64-95db-f7147bcf1adf1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="01e41315-a9b3-4f64-95db-f7147bcf1adf" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\04c5a443-d7b3-4cc1-932f-c720a8e9cb41.xml" RLTitle="User Interface: Active Directory Domains and Trusts">
<Attr Name="assetid" Value="04c5a443-d7b3-4cc1-932f-c720a8e9cb41" />
<Keyword Index="AssetId" Term="04c5a443-d7b3-4cc1-932f-c720a8e9cb41" />
<Keyword Index="AssetId" Term="04c5a443-d7b3-4cc1-932f-c720a8e9cb411033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="04c5a443-d7b3-4cc1-932f-c720a8e9cb41" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\0b564360-4440-4dfb-bcda-a3f20406de88.xml" RLTitle="Raise the Domain Functional Level">
<Attr Name="assetid" Value="0b564360-4440-4dfb-bcda-a3f20406de88" />
<Keyword Index="AssetId" Term="0b564360-4440-4dfb-bcda-a3f20406de88" />
<Keyword Index="AssetId" Term="0b564360-4440-4dfb-bcda-a3f20406de881033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="0b564360-4440-4dfb-bcda-a3f20406de88" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\0c97d612-762b-4bba-a158-036c1497446c.xml" RLTitle="Raise Forest Functional Level Dialog Box">
<Attr Name="assetid" Value="0c97d612-762b-4bba-a158-036c1497446c" />
<Keyword Index="AssetId" Term="0c97d612-762b-4bba-a158-036c1497446c" />
<Keyword Index="AssetId" Term="0c97d612-762b-4bba-a158-036c1497446c1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="0c97d612-762b-4bba-a158-036c1497446c" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\14b8a443-1d98-45a6-b3fa-74b80fc44519.xml" RLTitle="Active Directory Domains and Trusts - UPN Suffixes Tab">
<Attr Name="assetid" Value="14b8a443-1d98-45a6-b3fa-74b80fc44519" />
<Keyword Index="AssetId" Term="14b8a443-1d98-45a6-b3fa-74b80fc44519" />
<Keyword Index="AssetId" Term="14b8a443-1d98-45a6-b3fa-74b80fc445191033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="14b8a443-1d98-45a6-b3fa-74b80fc44519" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\230ae7d6-352d-41d6-880d-f02052f6996c.xml" RLTitle="Checklist: Create a Forest Trust">
<Attr Name="assetid" Value="230ae7d6-352d-41d6-880d-f02052f6996c" />
<Keyword Index="AssetId" Term="230ae7d6-352d-41d6-880d-f02052f6996c" />
<Keyword Index="AssetId" Term="230ae7d6-352d-41d6-880d-f02052f6996c1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="230ae7d6-352d-41d6-880d-f02052f6996c" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b.xml" RLTitle="Create a Shortcut Trust">
<Attr Name="assetid" Value="2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b" />
<Keyword Index="AssetId" Term="2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b" />
<Keyword Index="AssetId" Term="2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\2e8f3ff1-225c-46e4-9061-e758df8befa4.xml" RLTitle="SID Filtering Dialog Box - Securing External Trusts">
<Attr Name="assetid" Value="2e8f3ff1-225c-46e4-9061-e758df8befa4" />
<Keyword Index="AssetId" Term="2e8f3ff1-225c-46e4-9061-e758df8befa4" />
<Keyword Index="AssetId" Term="2e8f3ff1-225c-46e4-9061-e758df8befa41033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="2e8f3ff1-225c-46e4-9061-e758df8befa4" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\36b61c6d-d4b8-4e1e-bd78-db8204285408.xml" RLTitle="Remove a Trust">
<Attr Name="assetid" Value="36b61c6d-d4b8-4e1e-bd78-db8204285408" />
<Keyword Index="AssetId" Term="36b61c6d-d4b8-4e1e-bd78-db8204285408" />
<Keyword Index="AssetId" Term="36b61c6d-d4b8-4e1e-bd78-db82042854081033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="36b61c6d-d4b8-4e1e-bd78-db8204285408" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\471131f7-9aa2-4f3b-ad0b-03caf9a9ea07.xml" RLTitle="Trust Properties - Name Suffix Routing Tab">
<Attr Name="assetid" Value="471131f7-9aa2-4f3b-ad0b-03caf9a9ea07" />
<Keyword Index="AssetId" Term="471131f7-9aa2-4f3b-ad0b-03caf9a9ea07" />
<Keyword Index="AssetId" Term="471131f7-9aa2-4f3b-ad0b-03caf9a9ea071033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="471131f7-9aa2-4f3b-ad0b-03caf9a9ea07" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\5378c53f-ef40-4cdd-96a6-911ba6056083.xml" RLTitle="Trusts Properties - General Tab">
<Attr Name="assetid" Value="5378c53f-ef40-4cdd-96a6-911ba6056083" />
<Keyword Index="AssetId" Term="5378c53f-ef40-4cdd-96a6-911ba6056083" />
<Keyword Index="AssetId" Term="5378c53f-ef40-4cdd-96a6-911ba60560831033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="5378c53f-ef40-4cdd-96a6-911ba6056083" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\574bd0d8-1816-4d1e-bb78-61ffbd84ee34.xml" RLTitle="Verify a Trust">
<Attr Name="assetid" Value="574bd0d8-1816-4d1e-bb78-61ffbd84ee34" />
<Keyword Index="AssetId" Term="574bd0d8-1816-4d1e-bb78-61ffbd84ee34" />
<Keyword Index="AssetId" Term="574bd0d8-1816-4d1e-bb78-61ffbd84ee341033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="574bd0d8-1816-4d1e-bb78-61ffbd84ee34" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\6472046a-30dd-4dc9-92e0-450cebdafc90.xml" RLTitle="Understanding Trust Types">
<Attr Name="assetid" Value="6472046a-30dd-4dc9-92e0-450cebdafc90" />
<Keyword Index="AssetId" Term="6472046a-30dd-4dc9-92e0-450cebdafc90" />
<Keyword Index="AssetId" Term="6472046a-30dd-4dc9-92e0-450cebdafc901033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="6472046a-30dd-4dc9-92e0-450cebdafc90" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="relatedAssets\46681e5b-fb4c-45bf-a19b-990ded5bc71b.gif">
<Keyword Index="AssetId" Term="46681e5b-fb4c-45bf-a19b-990ded5bc71b" />
</Vtopic>
<Vtopic Url="assets\6d35ab81-0b60-4425-8c95-46f676d1ea69.xml" RLTitle="Understanding When to Create a Shortcut Trust">
<Attr Name="assetid" Value="6d35ab81-0b60-4425-8c95-46f676d1ea69" />
<Keyword Index="AssetId" Term="6d35ab81-0b60-4425-8c95-46f676d1ea69" />
<Keyword Index="AssetId" Term="6d35ab81-0b60-4425-8c95-46f676d1ea691033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="6d35ab81-0b60-4425-8c95-46f676d1ea69" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\6e36265c-863a-4f03-92b9-ee994e61b34f.xml" RLTitle="Understanding Domain and Forest Functionality">
<Attr Name="assetid" Value="6e36265c-863a-4f03-92b9-ee994e61b34f" />
<Keyword Index="AssetId" Term="6e36265c-863a-4f03-92b9-ee994e61b34f" />
<Keyword Index="AssetId" Term="6e36265c-863a-4f03-92b9-ee994e61b34f1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="6e36265c-863a-4f03-92b9-ee994e61b34f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\7296dc81-0672-4023-9937-c060fd7eef2f.xml" RLTitle="Managing Trusts">
<Attr Name="assetid" Value="7296dc81-0672-4023-9937-c060fd7eef2f" />
<Keyword Index="AssetId" Term="7296dc81-0672-4023-9937-c060fd7eef2f" />
<Keyword Index="AssetId" Term="7296dc81-0672-4023-9937-c060fd7eef2f1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="7296dc81-0672-4023-9937-c060fd7eef2f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\72bf4a7d-660e-489f-b475-bea95e8d126c.xml" RLTitle="Create an External Trust">
<Attr Name="assetid" Value="72bf4a7d-660e-489f-b475-bea95e8d126c" />
<Keyword Index="AssetId" Term="72bf4a7d-660e-489f-b475-bea95e8d126c" />
<Keyword Index="AssetId" Term="72bf4a7d-660e-489f-b475-bea95e8d126c1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="72bf4a7d-660e-489f-b475-bea95e8d126c" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\791d01b9-2b81-446f-a4ae-75a5a1241a7e.xml" RLTitle="Resources for Active Directory Domains and Trusts">
<Attr Name="assetid" Value="791d01b9-2b81-446f-a4ae-75a5a1241a7e" />
<Keyword Index="AssetId" Term="791d01b9-2b81-446f-a4ae-75a5a1241a7e" />
<Keyword Index="AssetId" Term="791d01b9-2b81-446f-a4ae-75a5a1241a7e1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="791d01b9-2b81-446f-a4ae-75a5a1241a7e" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\79feb454-7529-4742-9f39-5d6c0696e6c1.xml" RLTitle="Understanding When to Create a Forest Trust">
<Attr Name="assetid" Value="79feb454-7529-4742-9f39-5d6c0696e6c1" />
<Keyword Index="AssetId" Term="79feb454-7529-4742-9f39-5d6c0696e6c1" />
<Keyword Index="AssetId" Term="79feb454-7529-4742-9f39-5d6c0696e6c11033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="79feb454-7529-4742-9f39-5d6c0696e6c1" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\7a01372b-6eb1-4175-b9ff-8c330a616021.xml" RLTitle="Select the Scope of Authentication for Users">
<Attr Name="assetid" Value="7a01372b-6eb1-4175-b9ff-8c330a616021" />
<Keyword Index="AssetId" Term="7a01372b-6eb1-4175-b9ff-8c330a616021" />
<Keyword Index="AssetId" Term="7a01372b-6eb1-4175-b9ff-8c330a6160211033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="7a01372b-6eb1-4175-b9ff-8c330a616021" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\80304139-ee6b-43f0-bc4f-6a4196392d4d.xml" RLTitle="Exclude Name Suffixes from Routing to a Local Forest">
<Attr Name="assetid" Value="80304139-ee6b-43f0-bc4f-6a4196392d4d" />
<Keyword Index="AssetId" Term="80304139-ee6b-43f0-bc4f-6a4196392d4d" />
<Keyword Index="AssetId" Term="80304139-ee6b-43f0-bc4f-6a4196392d4d1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="80304139-ee6b-43f0-bc4f-6a4196392d4d" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="relatedAssets\1f6970c2-62d3-482d-a78a-451d4333f511.gif">
<Keyword Index="AssetId" Term="1f6970c2-62d3-482d-a78a-451d4333f511" />
</Vtopic>
<Vtopic Url="assets\80ae74bb-ccdd-4448-91f3-0038de553d9d.xml" RLTitle="Understanding Trust Transitivity">
<Attr Name="assetid" Value="80ae74bb-ccdd-4448-91f3-0038de553d9d" />
<Keyword Index="AssetId" Term="80ae74bb-ccdd-4448-91f3-0038de553d9d" />
<Keyword Index="AssetId" Term="80ae74bb-ccdd-4448-91f3-0038de553d9d1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="80ae74bb-ccdd-4448-91f3-0038de553d9d" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\828a249f-9fd5-405f-9cd7-0657de4065a4.xml" RLTitle="Create a Forest Trust">
<Attr Name="assetid" Value="828a249f-9fd5-405f-9cd7-0657de4065a4" />
<Keyword Index="AssetId" Term="828a249f-9fd5-405f-9cd7-0657de4065a4" />
<Keyword Index="AssetId" Term="828a249f-9fd5-405f-9cd7-0657de4065a41033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="828a249f-9fd5-405f-9cd7-0657de4065a4" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\845f4f62-9231-44f6-ac76-572da9d09321.xml" RLTitle="Create a Realm Trust">
<Attr Name="assetid" Value="845f4f62-9231-44f6-ac76-572da9d09321" />
<Keyword Index="AssetId" Term="845f4f62-9231-44f6-ac76-572da9d09321" />
<Keyword Index="AssetId" Term="845f4f62-9231-44f6-ac76-572da9d093211033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="845f4f62-9231-44f6-ac76-572da9d09321" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\8c0cd186-a239-454b-9789-cef187236918.xml" RLTitle="Add User Principal Name Suffixes">
<Attr Name="assetid" Value="8c0cd186-a239-454b-9789-cef187236918" />
<Keyword Index="AssetId" Term="8c0cd186-a239-454b-9789-cef187236918" />
<Keyword Index="AssetId" Term="8c0cd186-a239-454b-9789-cef1872369181033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="8c0cd186-a239-454b-9789-cef187236918" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\991d570b-7d58-42bb-ad11-12045ebe1ec5.xml" RLTitle="Raise the Forest Functional Level">
<Attr Name="assetid" Value="991d570b-7d58-42bb-ad11-12045ebe1ec5" />
<Keyword Index="AssetId" Term="991d570b-7d58-42bb-ad11-12045ebe1ec5" />
<Keyword Index="AssetId" Term="991d570b-7d58-42bb-ad11-12045ebe1ec51033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="991d570b-7d58-42bb-ad11-12045ebe1ec5" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\9e88fe6b-2c8c-4c1a-bc78-21e807eecbba.xml" RLTitle="Understanding When to Create a Realm Trust">
<Attr Name="assetid" Value="9e88fe6b-2c8c-4c1a-bc78-21e807eecbba" />
<Keyword Index="AssetId" Term="9e88fe6b-2c8c-4c1a-bc78-21e807eecbba" />
<Keyword Index="AssetId" Term="9e88fe6b-2c8c-4c1a-bc78-21e807eecbba1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="9e88fe6b-2c8c-4c1a-bc78-21e807eecbba" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="relatedAssets\218c5e4d-e17e-4dce-8fa8-d37ff02fe8bb.gif">
<Keyword Index="AssetId" Term="218c5e4d-e17e-4dce-8fa8-d37ff02fe8bb" />
</Vtopic>
<Vtopic Url="relatedAssets\938e20ba-8457-4f6c-83a0-e428a15c3e70.gif">
<Keyword Index="AssetId" Term="938e20ba-8457-4f6c-83a0-e428a15c3e70" />
</Vtopic>
<Vtopic Url="assets\9ef8c5ac-341e-4473-963b-32b67ff58c29.xml" RLTitle="Understanding Trusts">
<Attr Name="assetid" Value="9ef8c5ac-341e-4473-963b-32b67ff58c29" />
<Keyword Index="AssetId" Term="9ef8c5ac-341e-4473-963b-32b67ff58c29" />
<Keyword Index="AssetId" Term="9ef8c5ac-341e-4473-963b-32b67ff58c291033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="9ef8c5ac-341e-4473-963b-32b67ff58c29" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\a43bb3e4-77b3-4b2e-adbd-d154b346781a.xml" RLTitle="Understanding Trust Direction">
<Attr Name="assetid" Value="a43bb3e4-77b3-4b2e-adbd-d154b346781a" />
<Keyword Index="AssetId" Term="a43bb3e4-77b3-4b2e-adbd-d154b346781a" />
<Keyword Index="AssetId" Term="a43bb3e4-77b3-4b2e-adbd-d154b346781a1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="a43bb3e4-77b3-4b2e-adbd-d154b346781a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\aae18246-025a-44ff-84a5-fccabd63038f.xml" RLTitle="Enable or Disable an Existing Name Suffix from Routing">
<Attr Name="assetid" Value="aae18246-025a-44ff-84a5-fccabd63038f" />
<Keyword Index="AssetId" Term="aae18246-025a-44ff-84a5-fccabd63038f" />
<Keyword Index="AssetId" Term="aae18246-025a-44ff-84a5-fccabd63038f1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="aae18246-025a-44ff-84a5-fccabd63038f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\c88ba049-2635-4cc8-8f00-76cbeefe18b8.xml" RLTitle="Change Forest Dialog Box">
<Attr Name="assetid" Value="c88ba049-2635-4cc8-8f00-76cbeefe18b8" />
<Keyword Index="AssetId" Term="c88ba049-2635-4cc8-8f00-76cbeefe18b8" />
<Keyword Index="AssetId" Term="c88ba049-2635-4cc8-8f00-76cbeefe18b81033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="c88ba049-2635-4cc8-8f00-76cbeefe18b8" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="relatedAssets\722538bd-6535-4406-8c6c-c1e5170c4063.gif">
<Keyword Index="AssetId" Term="722538bd-6535-4406-8c6c-c1e5170c4063" />
</Vtopic>
<Vtopic Url="assets\d50bbb29-2ae1-4d47-bdb3-dc47efc111cf.xml" RLTitle="Understanding When to Create an External Trust">
<Attr Name="assetid" Value="d50bbb29-2ae1-4d47-bdb3-dc47efc111cf" />
<Keyword Index="AssetId" Term="d50bbb29-2ae1-4d47-bdb3-dc47efc111cf" />
<Keyword Index="AssetId" Term="d50bbb29-2ae1-4d47-bdb3-dc47efc111cf1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="d50bbb29-2ae1-4d47-bdb3-dc47efc111cf" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\e1d983b5-7817-4972-b6fa-28c3f8577e69.xml" RLTitle="Change the Routing Status of a Name Suffix">
<Attr Name="assetid" Value="e1d983b5-7817-4972-b6fa-28c3f8577e69" />
<Keyword Index="AssetId" Term="e1d983b5-7817-4972-b6fa-28c3f8577e69" />
<Keyword Index="AssetId" Term="e1d983b5-7817-4972-b6fa-28c3f8577e691033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="e1d983b5-7817-4972-b6fa-28c3f8577e69" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\e1ed9885-3d41-4ef4-999a-bfa40d54808e.xml" RLTitle="Domain Properties - Trusts Tab">
<Attr Name="assetid" Value="e1ed9885-3d41-4ef4-999a-bfa40d54808e" />
<Keyword Index="AssetId" Term="e1ed9885-3d41-4ef4-999a-bfa40d54808e" />
<Keyword Index="AssetId" Term="e1ed9885-3d41-4ef4-999a-bfa40d54808e1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="e1ed9885-3d41-4ef4-999a-bfa40d54808e" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\fb14e09d-f63b-4341-a8cf-0cad098888c4.xml" RLTitle="Managing Forest Trusts">
<Attr Name="assetid" Value="fb14e09d-f63b-4341-a8cf-0cad098888c4" />
<Keyword Index="AssetId" Term="fb14e09d-f63b-4341-a8cf-0cad098888c4" />
<Keyword Index="AssetId" Term="fb14e09d-f63b-4341-a8cf-0cad098888c41033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="fb14e09d-f63b-4341-a8cf-0cad098888c4" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1.xml" RLTitle="Managing Domains and Forests">
<Attr Name="assetid" Value="ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1" />
<Keyword Index="AssetId" Term="ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1" />
<Keyword Index="AssetId" Term="ffa72b21-7092-4b25-ba49-a6f2a3a7c6f11033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHDATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISENOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDNOHVSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHSTANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="LHWEBSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="contentArea" Value="GettingStarted" />
<Attr Name="subject_productTechnology" Value="IdentityAndDirectoryServices_AD" />
<Attr Name="updatedDate" Value="2008/12/30" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="Windows 7 BOM 1787" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
</VTopicSet><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpTOC>
<HelpTOC xmlns="http://schemas.microsoft.com/help/toc/2004/11" DTDVersion="1.0" Id="domadmin_TOC" FileVersion="" LangId="1033" ParentNodeIcon="Book" PluginStyle="Hierarchical">
<HelpTOCNode Url="mshelp://windows/?tocid=3ce6ed20-7607-4566-923d-a5328a21618d" Title="">
<HelpTOCNode Url="mshelp://windows/?id=01e41315-a9b3-4f64-95db-f7147bcf1adf" Title="Active Directory Domains and Trusts">
<HelpTOCNode Url="mshelp://windows/?id=ffa72b21-7092-4b25-ba49-a6f2a3a7c6f1" Title="Managing Domains and Forests">
<HelpTOCNode Url="mshelp://windows/?id=6e36265c-863a-4f03-92b9-ee994e61b34f" Title="Understanding Domain and Forest Functionality" />
<HelpTOCNode Url="mshelp://windows/?id=0b564360-4440-4dfb-bcda-a3f20406de88" Title="Raise the Domain Functional Level" />
<HelpTOCNode Url="mshelp://windows/?id=991d570b-7d58-42bb-ad11-12045ebe1ec5" Title="Raise the Forest Functional Level" />
<HelpTOCNode Url="mshelp://windows/?id=8c0cd186-a239-454b-9789-cef187236918" Title="Add User Principal Name Suffixes" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=7296dc81-0672-4023-9937-c060fd7eef2f" Title="Managing Trusts">
<HelpTOCNode Url="mshelp://windows/?id=9ef8c5ac-341e-4473-963b-32b67ff58c29" Title="Understanding Trusts" />
<HelpTOCNode Url="mshelp://windows/?id=6472046a-30dd-4dc9-92e0-450cebdafc90" Title="Understanding Trust Types" />
<HelpTOCNode Url="mshelp://windows/?id=a43bb3e4-77b3-4b2e-adbd-d154b346781a" Title="Understanding Trust Direction" />
<HelpTOCNode Url="mshelp://windows/?id=80ae74bb-ccdd-4448-91f3-0038de553d9d" Title="Understanding Trust Transitivity" />
<HelpTOCNode Url="mshelp://windows/?id=d50bbb29-2ae1-4d47-bdb3-dc47efc111cf" Title="Understanding When to Create an External Trust" />
<HelpTOCNode Url="mshelp://windows/?id=6d35ab81-0b60-4425-8c95-46f676d1ea69" Title="Understanding When to Create a Shortcut Trust" />
<HelpTOCNode Url="mshelp://windows/?id=9e88fe6b-2c8c-4c1a-bc78-21e807eecbba" Title="Understanding When to Create a Realm Trust" />
<HelpTOCNode Url="mshelp://windows/?id=2d2b8e71-f8c6-4fa0-a622-b4039ab5ae4b" Title="Create a Shortcut Trust" />
<HelpTOCNode Url="mshelp://windows/?id=72bf4a7d-660e-489f-b475-bea95e8d126c" Title="Create an External Trust" />
<HelpTOCNode Url="mshelp://windows/?id=845f4f62-9231-44f6-ac76-572da9d09321" Title="Create a Realm Trust" />
<HelpTOCNode Url="mshelp://windows/?id=574bd0d8-1816-4d1e-bb78-61ffbd84ee34" Title="Verify a Trust" />
<HelpTOCNode Url="mshelp://windows/?id=36b61c6d-d4b8-4e1e-bd78-db8204285408" Title="Remove a Trust" />
<HelpTOCNode Url="mshelp://windows/?id=7a01372b-6eb1-4175-b9ff-8c330a616021" Title="Select the Scope of Authentication for Users" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=fb14e09d-f63b-4341-a8cf-0cad098888c4" Title="Managing Forest Trusts">
<HelpTOCNode Url="mshelp://windows/?id=79feb454-7529-4742-9f39-5d6c0696e6c1" Title="Understanding When to Create a Forest Trust" />
<HelpTOCNode Url="mshelp://windows/?id=230ae7d6-352d-41d6-880d-f02052f6996c" Title="Checklist: Create a Forest Trust" />
<HelpTOCNode Url="mshelp://windows/?id=828a249f-9fd5-405f-9cd7-0657de4065a4" Title="Create a Forest Trust" />
<HelpTOCNode Url="mshelp://windows/?id=e1d983b5-7817-4972-b6fa-28c3f8577e69" Title="Change the Routing Status of a Name Suffix" />
<HelpTOCNode Url="mshelp://windows/?id=aae18246-025a-44ff-84a5-fccabd63038f" Title="Enable or Disable an Existing Name Suffix from Routing" />
<HelpTOCNode Url="mshelp://windows/?id=80304139-ee6b-43f0-bc4f-6a4196392d4d" Title="Exclude Name Suffixes from Routing to a Local Forest" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=0011ec45-8051-41b2-b8ef-30b9161d3223" Title="Troubleshooting Active Directory Domains and Trusts" />
<HelpTOCNode Url="mshelp://windows/?id=791d01b9-2b81-446f-a4ae-75a5a1241a7e" Title="Resources for Active Directory Domains and Trusts" />
<HelpTOCNode Url="mshelp://windows/?id=04c5a443-d7b3-4cc1-932f-c720a8e9cb41" Title="User Interface: Active Directory Domains and Trusts">
<HelpTOCNode Url="mshelp://windows/?id=0c97d612-762b-4bba-a158-036c1497446c" Title="Raise Forest Functional Level Dialog Box" />
<HelpTOCNode Url="mshelp://windows/?id=c88ba049-2635-4cc8-8f00-76cbeefe18b8" Title="Change Forest Dialog Box" />
<HelpTOCNode Url="mshelp://windows/?id=14b8a443-1d98-45a6-b3fa-74b80fc44519" Title="Active Directory Domains and Trusts - UPN Suffixes Tab" />
<HelpTOCNode Url="mshelp://windows/?id=e1ed9885-3d41-4ef4-999a-bfa40d54808e" Title="Domain Properties - Trusts Tab" />
<HelpTOCNode Url="mshelp://windows/?id=5378c53f-ef40-4cdd-96a6-911ba6056083" Title="Trusts Properties - General Tab" />
<HelpTOCNode Url="mshelp://windows/?id=471131f7-9aa2-4f3b-ad0b-03caf9a9ea07" Title="Trust Properties - Name Suffix Routing Tab" />
<HelpTOCNode Url="mshelp://windows/?id=2e8f3ff1-225c-46e4-9061-e758df8befa4" Title="SID Filtering Dialog Box - Securing External Trusts" />
</HelpTOCNode>
</HelpTOCNode>
</HelpTOCNode>
</HelpTOC><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="AssetId" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="BestBet" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="LinkTerm" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="SubjectTerm" /> UyT ` F E OfJRU]HtjR( (HA
I*D { b$XFvW Ϝy> Bb薛A+ *a t)\JҤ̨l @ @"t` ! Vg jH&QqYSGyy bWc=E8ɽ0o?^}7Iywqھzaq ?{0|}n6kۮ'mtú}u7Pz;\}^n^kv7^^y[{k8nr߿ ~.\
_xH~?Cnߎ wawp~ZeQqߦwp=#gsa^w7]u{Ջ^ھ8-6zkm4mmv=߂+[e((]mUu=I[Λ{ݯMtMpλ~NtO/\3s-M Y {<'xm||v}]o?9DG ow?7gEaat~zq/[svwɵxq\>{ k[nrS3rm=k;v+vgt@O}k;\5./̵8\ǵŸm; \yw_{ 6ͺY\kќOIzWٓ4eIܞt~Gs:iOOru)|͎뽑
osu, m׀/돍Q-؏-S ͱ{&7kN=8 {` cynW=E՝uߝV}Wܾ{?Ƈ]m.; clz
ұ=goߒ;ƚMǤ5džN]؏_=R3} ub_ [gv{lݱ{=0¯u_l~{Ewo -to2ulIl{D=vczX؞78E; =vcӼĿמع}s6zf/2?Iu=+}[3N[Pַnַ5ի~ om~5ֳ{վk5yܽ_koֻ;]w|ܾz݀wwb?7kI\uݞw/7f<xݹ{m>罪sU
[쯜~Us#jį:k5./~g]jm>|nq]v+kzgR~|}||||||v}}RO}.|ڥ5K5:Rs}Rv ||Ǿv}R#|ԖRzRw }RR-}R}=RM}Rε۽Kp>}0{MG r%O #m۪W 5{C6>Zwj|y~ >m<;{IJXq< } 탅 qx <pH݇x >}ًI6x4ᘐgw ~tZ Y~G:AN) /^}Ɣww?ཐ?rۻI ç ):t{JtX9ҝ)ҙ)ҝ))=:SJ{tg{Jt\O O,N靻)y{S:3>:SJ vOΆ|N)>:#Ss+>S:|Jt^dOҹS:>:?S3G>S:>:OS3W>S:;t>˧JvOΘ霚OμN)ҙ;)>:{S>S:}Jtl,OΣLN);t~p9:Ss>S:wJLN)ҝQ)9S:wJ錪OμN)>S:s>:SJ~}t|ҹS:xJ O Oβ9 S:}JtLO )ҹS:}JtۧJxOθ9s)>:S>S:s>:Sy:3SJxLs%<)L饳~<tɟr[x/^x^/ŋx/^x^/ŋx/^x^/ŋx/^x^/ŋx/^x^/ŋx/^x^/ŋx/^x^/R?
壡I>
;|44 ||44|?>GC£>
Q) CGh4d~
àGa4|?CGCaP>>
g
CGѰ4|4G?!h*?Kӏ!h:O?ÚGhFR?|4s>
:Տap4~
CG0h4~
íGѐ~4
Gh>
GCph?eGáp4}4g?!ѰL~4
յ GÐhh<}4">
JG!Ѱh>
PGáh}4R>BK ֺS~8" 0` `0 0` `0 0` `0 0` `0 0` `0 0` `0 0` `0 0` ~U~DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDGDnB~y5G=S ^{Kq=AOo'#)+M3 M4eS2s)y+\,v
Fqx?'i*̬eAF#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1F#Ĉ1b#Fb1EԄS` Y !CȐ2d C!d2 !CȐ2d C!d2 !CȐ2d C!d2 !CȐ2d C!d2 !CȐ2d C!d2 !CȐ2d C!d2 !CȐ2d C!d2 !CȐ2d C!d2 !CȐ2d C!o-7_?fBHpp\. ¸p.\
p\. ¸p.\7o\p.\
p\. ¸p.\
p\.qp.\ 8\. ¸p.\
| .\['[k¸p.\w5.v ˮ᮸p.\
p\. ¸p.\
p\. wrGJ >f >PwaxT >w ;\w }v\Oxf <MܟxaǷ }#G >t}цøp<HLSp\fq≚iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii~:hjjګjjګjjګjjګjjګjjګjjګjjګjjګjjګjjګjjګjjګjm\ۊciiӞkiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii;߶jjګjjګjjڵrõ[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[ծ~>4M44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM4 mn7qs;߸;q\. Yܟe|ĵ[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mVmV[[mV1g
44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM4=Mȋ4MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MMӶ4MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM4O۴M44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44MM44Mn 㚦iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii,4MM6︺g yz1 5 up7 ae۴T*pZ+$`mlXB&N$E%X$;ޓD(+2 !{7%|@"J4c: %s \,-rTɮF%KUyIaUk"x[yy6E28s5!Q8
wL% 2 d jH
0sЊ V{ӖzDE-;"sHa] C -[&9
TԓS=3O XcydW _ ~
_ǛopiفR;x
b
T?~$m| tj[+xܓo1*o <؛v{Իത|?.!^ 2ūySwwBæ(6TΧ<6
嵐ԋkj0 D a](? d'Idqk@A Le170Bt^6w8x7칐3TctYm|"EkiW ¬-r@i7-dr ȋrn ?ljIqw.xXU<GR)1JQ@
R]n- ]2Zf"DOȍ[[85 +)veW+!*iS˷T(*a0:&̯Jkfw}|rZP?W P ! _,SX!Ί U,p:aObE~{c:#ke3"H?CԾS ݶ8Ƌ B3i 1VHycջ:l9ǤxOVgu~
߀ſͱeˬ̃6E sH"4˘zH}TAzl?B[k
jBPe1Z Hۘ~n;xnvɿ5_1 t)/ĿDCd4R-4LZ>lwt0\%)# MABـT˲egϫ "ȓafsb ;da*i̽&_ĨT8sn[T866̟xd* ^F [||pm $TqwrZwp@*8hk;Jf2:HxPhAKk݁_#E,'fiM/Ir쿸E{{]m쓳S9jruԏ:6Lvc-6MKД5;L̇u7Cw6fLN$&Ί )pf(u p?5PW_{?p hFF))-W:3l%ZGҕҧ`P6\6.n B&W[cl =$q [sr4 pLvI`|FCL<DK02ID24}qq쮥
Q6
z;D[u؆
qŧT4,`4¨J%(wA#܃11nqlV%(N'N5dR*&f91+u=k
=e2"/l0hF5al+iE]M:F9W[826,bgآn m mtj p wcS"ymNC
_n:)rVt=8ݜ;*0SiY!:aY;?XwoZvL**97痮\ 5}lV LlVsA 6 irL=]1?fLTUkBm5@9$P̞<CZ 3\lµ !& ؓǓ[vaS5Az: =׳e}E½J&"#*M ڻRGѲ)enѦt"WMMQz #/E\ǠEZei%c-&>^8~ 6 ˼92Lq]N(T ][>A#syfjnzBo^`@A@ޡ$R⭢aVj.inok`± I#YI5gV ƨ'gIz8X[iAmN?hrwnܯtF*(5<[ ) n˩VzZ mP iB*"XpgA^ Sr[8uLIs humѵ2oN:
뻾lU p{b㟣}Q j}Mʦ1 2oXD %S<Ge:,l >6\]c:1LRDUB<Z*馅8 H5<r}7U\Y 0Uo
g^_\ &nJƑϵY"; ١Jo&J~_5[lwsġ?6aDB k<sakPC҄J-!nב/rhFKw=`߮lOd5oj-s^FYl?*_2Uyj.Gjk: pRs/fcrUc?RW!tr %
d!:1p(ar [F N>w?,um'T2;.kapbWFW fã, $9C>:k={CG"搭Cj[`SIZpSݠL* M?/kT8{ *
2bȚEɱKn}LuC <Gp_|m]UjK_H_ r;6fF鱩DUgL˷9Zcb[:ݟ |bI^i) g2|ͪSTp8|}UÍP\ש%<{4&S&gey*})]oEGĆbNhəd6S ͬ? ݶ{$#WqrGtţB_ۺۇ&
ȶwx׀[^ޏk-w
5v-d 0m><J\kccsPM$gۡ51'ݾmXV+Y0üb H$>x-Ovq<L &סI3*]6@4v |WxYujJ f '~F̉cܟDގ5PNSZJ¥t7 ٢'?|wG]wa;Z%~ %G.x:藢DE_7^We@z't$gˍn*`0 AR^ugyǾ+ {fuTdDd.c ]Kz{f]١zh y_ s ! 7 \E۞m =.d?-fP3:UWBu|K[
"˥2f2 siA+n DEm|#Kf /(L ߛNYnH2ŋl<jʧ=K?Dd-kAԀS
p
`Q s3)M;&ɞԢӉQiA\ͣÐu](!">iV4J'0M/0+lwʄH@Aܒ-G@({}þ?_e& ?Nhi G4,7$"CzhAl6"V{j ĩ0US#KlyBD)"|eq쇰Sr0ns0$n;.})nt+2#8 ?Ax0>2Ɍ 1s rmfQXXڰ_MaB~ `YDXDZoU]!w ;s^-'äH Tg\FOƜKQ& Uރ(j1̈́eUX#1 mfS 1g\iYP9u-bL?8 KY*uK*>$ ض#fcl ;
a /ES^- [" (ί8lտªq ǘUX
@H/TW O ƚh9f4!%GR#Pߔv(OdITzP+P_1DŠYcg%i.)IXAspY6)"!ͪr+Rx(3;v> 7_<ۀ$#cfӂtp{Pm+?> gKZ 佛BrTW]i?!nԁaPXڶbp:*y./(8һF
?;|Kd ř L/) _ږgD"b-mw5nP7X[<W"2fc~mAM.8m7|xcP3)oWJֱvb4BGAс@/|! ЌD<*
>m4p ]azE+/C$ C˓FGqi5 )$.-py\:%9@Yf k{;ߑt'A#1@dmB<GP.@|
[06 Ϟr0JZ4Ɯ= MZFiy3>H-^e-C YwnQhc~4b LM'ǣ
9R@M@bv~_ (@Ht-q9> +eTZlX&&}fAr.+g-h=oۉ#V8qM+۷7 .AzPˊ'8ƞ_^;r>HCco9ZR&I SgiWJD4=Zmi
"yd# xiZm]@ӊEq iSMx@ Ȧ$cXp
+)JkY2UzSwԟ`J9ܶ1&Alq:eeeXH.Nl: ^Up}(K}$N [ƐWĆ|6Ջ2ϥ'+6жkET5}ڎ&gθӱ^XY}%t»si>k,"}wT:OfQx@[< !g4@y S or,H.<C"g~Ied\Wcla %=7$Zj# <)pШz{z #3>/#5{ie8iX`y V O`Y]uo SGkoP. i~tBC18A=Fd\Lͪ e0a B w([ Y13ɞWo;uRy{U/'eZl?:C?YL?#oБJtu6 0*!>$u
6ІPX0OpU4BwMfp ۃؚ9Ncf<dcrul 4Ȣy̻.}GŌ %<o' zɂa\f걙_0oYrůl :_st'8<ԀtI AdXjEReu.u O uW 2Q-
ݽ] U<*V%!VE5SyP^bl@W bf@.6j :rnbڬ
};+*( oU4|`#JO|(NTx;8lZ xٕ,(Ϩ%z£Hƽߒ
9 'r+a 4 5 w
̍FSn`` ϋE²UL ނ*zoX0SF_: %h<Yؾquln#KA xWJKb2 ZEb?` L0&L` &0` L0&L` ??W IWm/:j<REU@4XiphBpm z.8UEWp53PmX-a0J5M/agZdl- j7\i@-tyзBqa%<x5=kҞg6/Z8 Ԉzoe@|F8! MRP4֠jp4p;JN B=#UzpzK/kt`hʪFtMgu8P°W@k p6Bu{C) qPr i7֪f} 5
}s G zt`$0_."U3ZSa%CF,\1lԚ<Xε(q :Z7Z3~
^\ߺp/i}x- @<61^ydFxNI lQ<\(~4H!hD,eZ4ˇۮn
k-κ7ChS/k;tB3 ^އzd,#~L%jVf̛9%<3/ M'I#%.ԝ^Tx:<Ǥy. -Sn 7<0D@z{JEr#! ^sZcҸ&v6kzI YRf P=č ht+$]n@⛮ C P-*z8V!9`26SM
CVC^qU&E] ĸ /'ҵsv(!Ͷ_fHŨ SS % ̏}QPϩgR;|>GKg.^t%( ťe ӊsOʨ(- NQ%{a/夋G%iH(_ nf>/ޗE} ɇźd:@u ENCxEZí0.hBΜ(Bl5^FCMk6-[dnuxPo.4ѭxy=h͵c;!b&t~U} C ]rD Fjcwh+\@=>ǻ;e%
)B3Ǘ@U=BaACA%b@(=OmZSAq jh4paW'P&Z gH^P%FAv8O*iؿ Eԓ"+'J ?و|v
cܬ=CKE|(T$N^![ 1 ЩA;k :; {#1k}a%PTOg̦K論t[~nmrkL^IH%u5
xp
Z;#vNV b[on8lX+#/,VC#ɠaSgW3X9|/屍(9QjoRWσ'[ 2JC Y٦ၐ&ȗln.-~jBšz{+Kz1gmt72Q2mqrW_k~~Qϣb*D:PJ@Z| (g8|ITj5Gs3`n씨[)63~z:3jrzƔUGQ[pX8HYn;1!8MdHUq;Y.bM JcfuAѬ`I<Xa(KJ3\ϱ/@|c7F52`'HW\y\)J
J,ʛ8.b2PXcv
1$&;Y9Q[]@S跤 4zvVM: El#?½ϩRܠ%[p\yA)1z ye^Cs!&~+%=e& ߚ{=|{lAA0J8KEa wbC jg/F0|G 1^?wNToCǦ =^X >^ߐ<(t/P ڦ%vm0<jwB0l("2iC.gd圗TlI{"6^/f+wJ"oqəH4,Uk1[MIcRDsÿ+Tp/4vs;N' ^! 9 ( Jx@PW<(%Jo? W%%ІR?>< `OD-o܋FK z%싫y←?Opf6 ^ wB~7}>I( ?Sh0a8]HJǦDHL~ x}}fwin~͐͌]PZ?;ni1Nsz(q-ߖm2hvjɘ:QE'p͗$^an-GϤ
trZGmrb jXR3ʝjq @ ͍(9x4Ģ<uB &s/lŅaP:2t UlJ)]\.PEt`]U) HxH "\,T]0־{rpU:Z t]R3c$ [sޭYP{(ġʩb2\}P ] 17t;llHDd'\3a vTQ}_].~b0Jɲ&Q/q~seQ⌶}/ *}{?Зp<|_:f-Nl{eʋeOђ,JqǫtED+sV٤$BLZF˶ݾ*̘A\:dt}?qx^&hH`
cU!EAVNZ$v# 85uY TΆŋKݓ
4Kq}FJOjFIm
,q4HXvs-
Y5 YYa-bBmQF(Km9:̀Ǒ;|e. v2wi#rKdPJT/Gco$ڀ)Acų\@8Y˚Ԑ0G
N6o_I=
CF(dףT.:,nSuƌ
4KLWW> rhn<fng3L)!┳i,E@ #Yg7h(g4;y @2.0!,?N kPSQdQ c=F->d0so6^P$/bt Mă| dg3^zÐkON@%u&g` +1! 6s~c p}7z}dȷggDq*K*Y$k@+ʹes/+g/[p u0ʈ \x.-e M4~ܵ (fӶ?OݽpA\<J*1S#Դ .gq _!uNat)HZZ)y9>r^F%+^/EigN!_>GDF_3FJmMayW-
'8Oӓ`<'
-5s-]'9}((P>}= X->bcbw Srď7^qqY>l<o/ +hx8u H|;uE&FzUöa 0xG9@]>($8XJ )39|NsY%ľ [m^˽<M0<#E=h;PP pLh:Yx}T ^25,jfuda3 `3?̂m|XǾz r?4_K8k6캵] 1%]jP*b4 xnth
iO3(@.A )" w*LpXlY:˹Јj2z\^̆a}hAhw1 g)KR ` ӃʛJE-8_р)UɫʦF"#)%GF~R\lڠ]k e2G.g65n{ݧ ~dM I4$qZl[7|a 73[]gxFJ=>ю5E
wؑmM+F $ay'?ۚ8Mݭs{xؐm ;=| E 8)j}8rE2bұٚ|FMrJJH,FFE.GGCסǡhg1JSf&_Q T[Up|'Gw Î;+c%e/7 yd Or*Иgz؏Ts%&o:&hɸ'F MlU843ftif;jv6 -&6k.dJ̱= 5ub2v2ui, +VY(oXS*Y-)JX
V{)N?oM<:var\8ZW]u8q Q*Sgt/γ? ]tofa22tz~% Aohnїiߧw}#8$ þ< ' ݧ1QW yDt9<9R- [ZcjҬ}oM>%9}[N.8 ͌i[4c1Kr<G7 ʶ<K3O3G楩1[
l+Ƹ& ,5o?~,3I ƦOfQv:DpQUn$
q!|9EM3]h-KS" :mVKCR% O,twdE8Hl2lcm>XuW9Vk ][6 qA[\' Ub<s:15B8iDwzQrzaTmi<UA ?3 5}v&U s^VTδRe~&&7f1,/M&awbPc
!~օN˗^eÌ8D wn/qjg۷ܝZ-
Al=ŚT#)]M [+ rcnzJ`ZsLvj.vO+ hsgsI_Ӳ
0jusk)jJ,)<u>Uר.<6nJ̙ͭDW\K^1zFTr,M%Ψ)>4Nj+uQ
Ǎ> t˽RCu;[DoTx46oaO
u6JMK,Ac0OԱ3ZBMrq
b)!C˴*Uꮮ/ Mn7@iΧC-.wsW\iɱHm+o ΞzW1p8i ve b
7Ӄ.c㒖qHZ9A6-ܷ%tEPc %3/U|Z4 X8^ߊ݈* ir5`~t·UrU ;/}^%/TYwZ
зy=jӠ-d;5[a<ܩ;Q&gE2$|<$?Sěi1p+w{k^R .!&QW<xCg +Iuh8|^ g&Pr.m gL =݉[(Á-yW϶62 |VPSh~@I;?og @Hdk6UG/}(?~sFȫ&'Z1Ee6m Z}Asa| ., ܣG200=oTVnQAk'j@8IS'"bN((w[`\[L;ZޭTcj(E] 2ݼjdoOY#g &%0SmwO[a;vyAMi Fp`Ę߳yq҈x^ ;ao C .
c zl5+}^ٷ(\ x +Q4`:\=}29)'NmcJgy۞g~>k'V@tׄA@6\ >6tOCD\aFLڵ ;ei =(ܐ % t$5D,ύ`L$+R ,D'N4z߽Q] "8w$a`3,H9 Fۛ@3;A?Uk{e`#xǴ~n
$qb}#( /f&QmG·l>>wɒ^_¢br ~]oSғH/*8+1hIMΣ2&#;JP ϲX ,pg%T'c]].X$; }ʙ̔BwJ镂ضk 0ޣũsMȋYɌ&`_Cs ]7~ĝB%AptʴS_ )MDH*LftOĻrx5WuYY2V*)\y}9.->`H04D1'q%G^x?i#J}wM1}CyUB "."-2ss#8ݚ SE
{Gԣ ;a>#w9ovl\ޠiѭ6߮ݐxܛV5ߘ}!rK҃Bi: `jMΙ[G3NWrNlXl9b?{WbYy>J%k}/^X6 ԵG.q;#s Vt.!.Y#(+9UfCk}"v%;$|jF>dt"t)݆ɔVjV{, yU|/
)&K82;itxU(|li*Ph; ={I¬ɡ RT-p!>Hy҄0M g7xw#:iEw$Ii:;V=.!>3fG6ݓ7yE14Ϯv`#d niA:ne ,%z܊ Z4NOLo%~p*/TCϣ fvnQ6$_߶,S@egad
f}& ><< _j-۴c}'<g#I38T{ƲB!PwY?(0~Z)&"5647"X߇iж1 `X$&%R*nIBiF
5UƲ:8Np/ [Z2vEИS#
Y7?6tfb2
f
](Kϰ`-zv:E\kEgӺc[JqS`=C?`}I NԪ-njO77 , G ']'EVa^#Af?~<1O=1n1t"yHXeM^ 0{?-X,<4>4P&f+͑廓LLqbktP<5E=Q`%T [`ˡZJS誣ٽD<*'srD
#FhK=]vQ_ճx{<U״8 ppp Cb,/zjoU}ZNdսsշWeiޢ0C>*tB&[0|f{Ę)XeyW~7gY%ʣ1:{;d9yY|%A x#L
G &ӣTnx鈆PF\8Fn=41,њ[n* "TQwͅ [!n*" M9}* &zZu;?8k@߄/8% `2
6HP,fRth'UC2*bq$Vk6r B1#.26'P'rvZ,-bJtqH>vS+\}-چ[HrE XSc3 Wؾe{' |:A+i٬LI0:u &TABO-U!aRruƷ^mP5XCMcVtE'c/
2'le%M+&LLW"|>/* Wב{$Pm
İwD .AJT{Q1?`%. q AQmR1D0 "Ht'gL]m |4-hV5XSk +b-S[4 kF4 l )<Lu.9rMg_*ZDUnuE=ؓ.\ƊTE5$z:7Lf;8m'NRl^EMxg-V]elHE({\֟3YhyA
zBhK.)h8~ l
<R
02XukvIoG]iYlFu )4do\tghNa\fkyS;jzX$h-:CVJ)ŠnlPXcU C4㘃)Af(c nX y$i`tCDZre⼫zm A}`l^:PKEZ tbC-B;ܦsP!X(tTՀZ W$nFDJG)5xdҦe3IE.4]p%U`Cϰmujv>& #7Rnk/FdH6*ގKZSאyѳ`w+5yNUUo<Di2Jk>Fx][B,$#oh)@˃4 7o=X%iF69ݲ[[Ș8(Ê@arўhibTX5Z(D xvة e,KO*ݽ!q F?a^ TQDAIϐuCm/hDа8_Y m5Ҷ3;2ʢ8=][ۻR ȃ9%z<Ձ 1< ;(; g_ R9#[U)*GxNO}&%Z%$/HÄCr#JO:Cq&`07x@psA K zb h2 njj. ʍNsqOR ]o@|+}&TI6>\(S>xPUr VU'/8bODՄ
-b'd?qGƋ,5HϞfR
@18] Ē %+[G4KQ*"Po2˫J2b"G#؊ =
-a _c o[o٠{_=pr( |Z5{5AC~tJnk]:^ХIx^GKL)7] i4puk<_@vAڄSuZb=ռKaW@~ o]ga>yw\0|?KS֦}>t^mp'|HM_2dtyx?a7(L֪ >Vd Fl1vIPpOݗOjj*{f=ęlZdt^\J^|An97 .
R Mm=@ ,`' H_ƚ tBwdYGh g c ez4 0fSidnJ2 u~mmh=ZT+ehN+6U^K.)k>vT¹"Qn0L E}/J1ʩݏϯtK ImNYKkPVfw㽍q̠;3Bu"|EK G{W6'MAP }u~R&P[PDEw-ŖV6&D9eQOY<;^2
ly>n`h4i&gi#LVnUu$TUW[VT-s|HCbBOq~'ӑI6tܞ?yL )Eܚ!5d[2*3zc8ePXbiWS7b_e)36k8RIS Mx% ydf? 6h(D7+ \N+y!z( =y YR9`dc2|Eeo.{P̤\QHaAfHۗh='ԔZ]"RqZYX!@mu z|m UeBn)2V-&s"&;K :?L#] Q<
:B胦#Q:ɡlCןk|0-]yZp `oTrPd2A#vQ; UeZ0ɇGc 8Y rZ?ŏL /зre
K yWhfvЋ}w6Xi18A^h5~)nv?!??kQ+O 'cFhEI Aj!D .Pz<c.CSk]/CI}ss w??9A~G ei *d!-2ZC2/qSC[C&'"_3I7tfwv6bAIj1e]_. U
m,__dS~p{nFEWR#n-煥S$<yoұؿgj Eky~_R14#6%
PxekPU n.0 wӿ//f㟴{8 "=7[=҂߯Ku [R-fasl`F@#̻=ܔrB -A߈-DoQ#d Jm""
[` t M M ( D^xC
ֳm0yY9@d|dWXWTWٻ ]kZ7%XصMO D,ziK-e82Mw]Ktoӈ9F| ն$q/S* 7/72Laot?j KsLE3
ICVwuw kbPO/C.dp=k" EM$Ck[_r$D
qφ5Z;v; o78
<HX_4g#iUÉ, ZO8I @k,;<
3IN9Zb.%nk5I?ON >O
d T! Bj@v41Fmw2v <q; N(z *,u䪡 ^~Ƕe"iCbh Mձ)WF nl)qG83D;VJGіf +iPaoX# $ҕ;R =&n\OoEh˯? '`6 =姺_| cҳ7\%9qS!A()[?q? GQ m@hv&xl %y̔?g@-(dv(
Q 3O%Xz@R) GbdFZz'=}ՕYJ{`[ 3 D
S˝.mQ 2FJ>u_3p6g P!FyggG/ ƿŽ'I:Ep';LL .ħcu:xpT*V*D Ԅ1Y[lfдwUF"+S k5 GO}´e͓r_u>bPlZt713^cE@(6 ,VD > |n2Ga tyPVJ)T'
8ޓȏ"PGC%
f1!J6)u 0iad0oVpi~^XD #Q٭p C3[8f BO]+V#zq!{T4J
Mys 'gM]) ƕS>ESmIBr
-qY7|K>$ o *5msUD 77?<QA-e:BHl#iTjjIƦ͒Jk^.aKG[r"1bÅJeí.<U4p:fFrDM&a<S A'y T! 32.iY~ Je5-*-4 -lf ۄu+ 3o FtXaR8=xN;m3\ W @]ї{Vx T9a8 r"2N#[XVIU M fs'!ސy ǹ,J MkHY) 闚j>!uv
t 1+MfA1E d@v ld[pݪ0s@X 2֟<c#3sϣ $)A3aP=(hkqA ZbQqgߺZ9) <v.O1ޘl
pm㚁{ dcK%$l X=%[ɼr@ O#P&!.Է[LRE|U!}1Ucs+|U
%̷:^^
$=@!;8t\v?|Z?"S<>9p=2ythً?7'ũf4oq x7]NM)~4t psU` ֨nnHqjt+9%HάgtbJDLm% !Ztvwbj#
' گq n]F՚6?7ˠ#S]}dlkqY
cn\? _W7l65jz[> CVooQYf~*|_Rˢ!.@?$) Bw| TRL0Ęr !ⱸ\IJig?(-:<ob_ ^yDc]ob|ukٵǸyFT@0|0;P_ x`z1KfD@AXtۍvAjGKڰd|Y$&LgN`) JRsȿ:d̦Lh2D J8v4[^.ᘑbPUS,'U/2l dJ aOMďN^ hq5hR@}Rc!),A=dpyzXY~Y!
Cpj;mV3RcD) $aa pg%~+i ӽ 23,k#
3ַbwX źX\O!ffE`GPnqG~+3Vg=" e^}?I CҒPor3F#ԥ`*\6 5pI-e[:nN
^NR2~)"BOd(SIzm+T"(]Q-[x~ @e}_ a('TEҤɫIxM C8=V%%XR5Dbr@xuu rldn5 R _тF\(^-+4Ii@k8_Uh kG
bS29p=߯ 6sqUq(16^"(ё8O[z*ۛ|o?D# #pI5d=9ŷK/FEe& ]E._` X8--C@3D< qR.F,ֱ$ Ҽ^Ԣb`I"`ky|#= 5|^Ϡ3m|1Ȫ qd"7(F1]^q!@ 2jE[U"ut63,u=V PM IWV\60p8p ;48>P}qmIOtGFyxY*搜eGp\GHo%x
#
б HÌ?< UykZ]]
9Om)1eg$S9`}O? n!2tKQ]$6ugrV"@)d@S"EtMkԓ_p $+MzҖjK#YFK6Ny@6,o 5&5ߙTGHJ&'ӱ)չ{ >~V{
Őipk' <DZM7R)-T8!-O7!<: C
O1lu K oBXS5V
,,O<>L֨|~zRX/
-fmF
<!m|st\0﮻zʢLUMc&rAcNLȷFݼЕCDB O%彈[?ώ?q \R-8M߇Z
!N&.:QCCi#[̅2+kR+"3t!G/ GYY3B4,Oھ\ 8t"pk
}ٌul2A]
&Ia$K&h2Zh"˶07(Z^I>{8)˙!I8b>j <;]5χWk x N;)q:pէM.Je =cv=G2Ī>1 xy_G4zڣR}blҰ(Dzl1'% TvQ|\ʏT ++%/o*2.W(czH(h *aZĚ!Ng'thZ'|u Py?8up$o/ldE[@6 of]:O~)|OI J|$XW-Mě: JQ ⻦m0Iq߸gH{X|D6ܶ +D7!;L
0pNVmDk,Ob>nQhIC sȴ8bAĀUjL"ځE`d-r píwCܪWgof͍j
3 JO Δ*F=8y 3.4͐=ˆۤEgsՅi &
Y3\4ۑSq&xyPņ#E L:`LW%%v!{ˤHv<4.T?j/lH{9~Dţz8[ q`D99j $p<,yEQ̰`p
($هű,VDe1Kop31GgMʱ6҈}/Fg[g0ݳe4TB**UV ΒhH 8 \/.ҥ/eU9,F# ƍGzIE Eʕ=\W ' < K1X=?IaoH75ҿuSȈ_S^9tY~zhwJG'W(X2}əGѧq¨8V.AܽN~Fl@o 8q0 M^[@101
۲/!Z,hGض AcO gP[Ý¥r> _CSsڸ˵ 9 +z ^dt@% ^)ǚ\;F /ڌy;Rn&dg/
'XNzgd]=p.r/e M|I!%L
G%/(\>;Mi~-0
dN
PS6- a;D;r&6ғ )q'7GV 3p ~FX`%jG E|<cYXEjoIsUXDՎXW%.,K5ȱ`!`3N4w/4Aqq&RWW#"Yp4vf =nU30 HOlOqx6;r}]_]O4GSC' e[R/0ɟ9у[KfDr_kZ/*B!k] {˨j1w(x:Z'!6w(DN', ",㛑+td`]H(h&ȑsix2k +aEN3z^@3Y mLYֶu\- Zz-!ߢ7?`bjhɲ
Jq^E9d 8eH ]fN:6pN^UrmGIfbLB *8{<TVy'wߥCHҟ7
F32@)gՕf}|V4fd3JB>myԆMfcp3<҃3GA eog8Jx̂&Dk lv XH<mNG!,iwP" p[@!n%(-evEÙ[j" Ua:~'K,/UհRl!(aqDuH}I]QDÐy Pే HmL#juT'cQK"/U1ˍI &/9 ÃIg0okn"Zg?f
2vK -PiB*e%ywD$ի"EM>m : "5;ӇBL<롓
n Z >q4 /V 6GFfWטMYPb%v
NĨh;!\afa2Ӟ>1|"qG8Nlf!?ھkc{[e#S4! ~a~}\OYqj i -mޑ7FR7y\#\!KBohcЦی~;*?U#|d
F̆G nxWqhLrռY5j_gYSy mES| p$9<ۉ Zd|IvW5D,FdG^m8J-KLK-nH~e3 scN9krZ\r* *Ul}Ol5kL|yS:M$8PQ# WQ=,I}+QVz[YY
|A ThɃ2e4Dp"z+cmhh胉ߒ&q
gة;Qhů>pk̆{ӛ1+X"* ̪冀ϗhMؠFyK-_VWݯ_srҔ\LQ}-'F1dfhWW-[n
$D
ݼP`i>!I&.'Wբ3!B .4dyR+t{vG tR"FE
&=
~a ̭a4ZL4^3oHKrщ.xGt/#F %:;UOIg#OYJy"(Ox Xe/8tls Crsv?k@
bX0HO6 -@~1 ײ )%M@od 9&L` '0L##dՇnXjD5n20n
D- ZעUK7ܯ``DŰ kd9zZ,]Ndoe 5^q
~(OSIu~2_T"`PMr4"Ł>>˾Jc.:-88nRVZ&H߳H.`[Iuմix6 CkZX%cj4DKp}ρũh=.,=2pBmVRمEX`D|U3UuY育ߜU P!FVR'עV]+N| Zk pV ]~7o$ R3<!Iq$hs\L9T8òp:.Wt ^Pi<?_TA3j.?28.rVFR> <*ٰ V Ra2CBqQmh.mwc iNd4z
u&9E'rUl2 K\Zj:Z4Q9p-i>5,/oV$NΈ 0"h)ojHR;m*C`-jnD"/6 =9Wes1-'iEwi{Wq³b9MI UvNB ƻ[30 Z8l - q.y^,eϳ
Tl0[x)s
0噭j<*[АYY83n; ;!E: 'Z-"8E0h5o38Y\ 18 ~sJC0vwAogvZ9֊jךBL/xj+oY5B)~p3V#+CI&X5B̚*8Ҩ""L%n̋ E#闏X@,D8q{=2NGI|`q Y M^Prwp]I
I S
*bi7aeQ,sXfyJd( Gkƥâ-nD ɶ
)-c,UD3/r~m:*H)z |4YWK'Bǚ- N-vg[VJJ3EH)\xwKUjB%3^\ܢ 9k:GIF@&2rv Ϳum:-gW/Nw aGF"*f ,N7};@<]i.Tui8XE=e댒%aOApZy&K%dN5*HXYyK{SG#++6.93ʖ9ӿm%X^ r WGZZ:Rd#vGq#~n u]1oJW#6K<Iq&-vY 7$ry
{rs:>{1k~$0ґ"3P(0\.s-T;@*F՟n* gZjG8]LW*L
|t֪:c \α `ᱭX:xK7(kz5aʘ;kI4yeDi }l
O?cR,B*E6l)/|Ǖ
U&V/rjV5" G櫖&4VxZ^9^.P绲+
v'[j Gӣ' Ӵp1qfnd$Ci* fҊFۏcs fOTJ?Oousq pDXunk'yZ剐G7KSJ(r;IPlk鉃l>[̷WmvX.qQ[D- u߽"J
miU
Il1$ \`33
D|Wr.Q\ .fkq r,%pwb6G*u6v: m7vQrV}>`ZF=;b U B=-$J?܁+}L"ܑ#' sTc?JtE4 1 FHh}0]W!
*ghTi.Ҕ);u,`1׀T 9{uiL帊0e p)N\6m}<ܡ:!"\ m@%XM-v93tsMi& Y Oc'b]J+vl~ S]6.\h!Ϧ %CU5B\N:m*CηrXLJD
:# !1SV937W4_5%QڠX.[/l\WA;89r(eDy8>L= gxb`1KԏC,-eR82r-ߪT#KVC[&ǣӮP%%w<-zI.HM )\|e7ײHMѼ-\&pڹvΙ)<`
%UX>g127L TR]k|Ne[`
OZdZʙ2Փ
H# Ά<yalZ`x)K+F iu7e' rNc]Qbt)}0
o>xq| _oK9yQOP\]Ħ7 Wmؐjx+멚; z}#
% Z"QPMSRn~}$,Ԣ4Oyv>>[dPg?# $ߛ:U%ڶgY :W
q6+1Ab-ɷ8$ˣ u[*MNYQ4J`Jbݭg RҚ2!Q1B$^57..|!H-EWX椣#t 5 ڠ#FO番hNw{wEKi: #P~MI5<$jbPhhC8Mvh.u_
]TLfX9t]f8ݷdH_mEEЀznhP" QEٖR) K ƙ]_~t?O[.~y8R*'c FĿV 4MO ѧ)&zB mL %nW NVg| nJAz#R</q' 6c& Pc[O J֢ g;zn'EW_ y;osrPxN[i[
lLd }s3$"L|(k[ ĖIaޗ6ǿ N~tyDxGF!m]o!2N۟Nxݕ$J瑏7r'<r~0}2-- ~St=lv]pD gD(~IQ@7.fb!uo)~Vǡ앍skǿGY7So$i9;cK]~罹>
?WwyO!f}?=Z@G{&q/6)ĮZC @- PBԖ(vȉ H>Ƞ ? ]T뚥 zȳԷyO?=ֽ۱K#}tڭ{t v^/=N<_K{Ǡ>rϠYڕo [ULz]{Dw 9;z(A·فڹ% ]SoБ7<#
h i veߏ˜ gΓwzX@XP<7;K{uwnwF*ud݆h>
Oך46GoD;·[h wwy ~0j}5w t=YOBykAV\`At'H}sZ ~iguh'^<{
>v:8Bt\^q@{۶TߏzoF- is ɉ|oԠd<A:h.ڦׇ%'Bw{>ޫC= 웼
4ԅ m'"oxg ku4?z=o._\'| Yw,:ڜ=uϾnUo}so>*' ~8p~u曩;h^O@μOb{z}G
zm`O =Ozx;Fw67G ͂ ({P\G#@g^&z5ac 1hKx95@9o/ O/m/ o[7{k6:
D}䟳ޗڐjm{oz Bx6P{!0w;j.|d9a H_ '> xӵZ aO_EwAۿm8q^<x̯҆Z[Z}eu\h1>.1}Vl. óo XyVg7O
)U! 'v7?7;;:<W()boàx<O
-$
/sf-lʿiYx o7 u n<N7wwm{7׃x'n w"y?}ٜ|_c#J ;bisP;^~uA+sٞ{ x[?ю* X6QkNJg<Ճ~%c{Ӷ[|PU' O0Ա:o99t_{9쁋~e\՟/k'.1O PRh^5ɴw|]NTrG:/=7C[Mqr$~>YӹtzBqaO{ ,9JCί0( =Sj{,~ѫ >'`d> /4BsW66w4\ Ӊ̲ g ˼ΗߋkT^?AʍSR7reP1k~4D|.6>oњ)G8Oa w7Ud h9짘@*[ HGo% wDc]}U luN|NQ`oY=WqRo/WZF '2"9?b)VWdG֞R ;K85jx?sYIo\b.(>%t{ oYX^|v8@/@ѪѩUK1eydDP窯f3]y JDh-˵ODR7c((SKx<6Oҹ*aArbwSGrԢ@*d0}JOg 3 iT"<PW |X%qƺB<%']Jt8}JOӝ]X)%Web}`V|x @?Pj~Cޭ1t?voa!hǧR:#&BZmjCL9(d HiRkY\)eR&nTo}h559ZӭbFTS- wsʻ58;?dBjCmiw? ( 8 H XѰMn&Z^n&n&bBFos714Qs7M MMMM*\E;vu zvwoW'qn4g='Nk9k99k9;9&^MĺNkҜ YHik$Қ54}Ngl'ko5 iκWqޤ菾^G_)EsPU ] uU S3 E" ` ox p'Cݗ{e^ AQQPvUpYk HLhBbHmb!mH,4-bI`6i cw"JZfHjRܲXy[L:Zveԥ-퓔Gc%Kn rMddqQyV$W)h Bٹ֒l
#Gd;w $b1B#BOH߃_ń cd:gtQ c.5C9ap+{% !(=P`S b7rSv 8Ǒ9
2Qt"[
R 1Eu :CHDd !}:lJ 7 ݺl6ӕ JȈ ,e7s2]5ۙ-X+Hr& W]4<4sG& v/6ȩR[~\ΩC_$<[$'
U5.&9 Dt*x TTG$ 1xc Vb, hb. -D
J8谜Jx3S^eͩNyLS_q?\ (`1b1!:׀ʉ̘NwR̦e(y)4 me 9*2&ycL<%ͱW"#AEzEr
cM+ Pe1QcXjCvt+l\ F.o[Y5yr+`<e*JF",䍀ȋi\F 9&1\X1 kL6d9Qh?Yuei,~BDY8uvt# ksh; @<hJsp RJILi|m7*T`ڢJ7ɼͫ ̺'w{r,\T 0e g
A0NYX5̓!Kˠ ?=W <J6mntt tZȬSsu
NTSTI{$vPlZy fbl*Vɔ
A7sS g#Ee|?ccIZsUu oUur:u64%ok'3a5 5a\DMf<MD3NԨ1ygڀ1M9;UFnV37a
"%j'O8k5a; pe'd1G;[ %tfeDwL@'SY"6p٢Ir *ɦ9 $5h[ls7jsԟ_ͥ:c xضrj1BQح8SeeLkMDk~:R[LExG'X5LR33_pkP&j;d Wf> C8XSGqPkp&j;:Yuc))Pf .i& c5{uSy1'i2:E㏗j"%j'O6nV ަ7Sa Rְ*LDݣUR;RMi;NkslD3iQBQ1Xt2d%rP\~1°ȬS&=DMvg$֞N .7WdDM䩷d4%C?@?`}@ emfYuqA"&Mhrtyh ~DM䪘!7B;=ΧW$X\@ 1 DM䩮Ų
Ƅ~55bHr>2c@ \0[vZ>IndY#48Kɘ5l?0%jAO{';j_kK;u"j"W%I'>?Rڵ}5eD $E>:i!j571QE9jJқP PhJIERn<mcy` ~ M?,㭳]q } \S%!$
=dc#?,!֘mmr x$Hb!06s,,"nB %|1 \?szJYtK9yqtxxM2ŏ ~nßq!P ~-?[˴ KPsW@!C|I_s+Uug\W&@>3 ! 4%!5Q[88 Ȍ5X" Hbe7Hyw /G,t{\6dL[L_ZRxO[2fpƖUDpg '=/mOϫV0RǟYSH,]Ieܜ g"fWc/C)32'617Om,<#"MW2""MlWY5ӡ`|K욪++1E3,)k ++pWK6}/X_
ܱD,3͔2C(1L)v]Khĥ?3h8۟ij6͆TPdϧi$4<24<i Κ x5FQT w4#v槗QL^~(=ͯר4si7
CcZ6I5W4K9m_3MM3Q_afSڝ}-k+YsE
5Z})5Z/ g̯|ZZY 4wlWڱ^b yv뵘Q3ugMNf.I9_|/F"rh~;_/Wʺ&ks<tZ -~1^ Z$"9'Ŵ
C'噳Wz_Y%9DD-F}_; KK 6gA4TZWSH)VYufK=
f.#QmO-dA^l@Y\d0_*LYV?WW}"uxZcPL锍]mE8Wv@F9wK^eEEĺG8lB6h$5DG"trJ@ehEVNh18rTdmo =
;MZWq1i#2D
1'p+ TI+d!| &+YP;:\ESysσYe7k8|iQ=_75y L
k@Eϡ( ߕӧs>-~(YCεQs[,3g=Nw== Q/~05
w/KRݨ8OV<X5 䓢:nh缚-
m?8& >˺ t](5b/+~Ն!\\+B]?KIJA`, _^&~nY/>u.
aZ.Dzya(N z^]g#j ĭ1Hi8WRW)**6%%EeZ4U7Y\%dΖiqLVdiJWI)*:,Ғ2<RUDHJˮd+â 2{A|=!X"ƹ.H"ˮ4+2PUJBVdq J ˫ȓi>Vci=]VeZ<UIJM7e
>{w
Wi
CO7hż?yNX1%B(`Q5Q^|E-lo$> fYbMCki뜙dvD IGX7w7bJ41F|Pu?-{ 1mh> Kꉹ ^V(Im` sģ8ʀM"z4-"4lr
r.p:AW'D TɄdLF \=JyJ ALQ)H.j=J#=G9}
q#H=E(Ffap*F`aqɴU^ e%k6glZ̃He 4ac94p
FUZ
8XXur'e(( Kn`j;% J45 hߪ#gE=c;n@@9 0(٣,:TK
g3ͭsUJP5EY?6P{F`EQ] YeV'pRqKM^-d #Ddnk!Lf((Xj&6T-Ba}-sYZ"ݧwC`(f(ܛUTPNTW0D f+JJ "Jի).ik5]-{ԱG)hHyB ԬN& hu3Kò' V?h{D 8:th-GIdeC;kF"zsQjSFZ2ߓg_
K~Qukȏ$Dܶ)9=B
6H\p[ oH^
xpo߭gww<-%|p|T=*<ǂatvaqkg 7w
,:-إyݞz^; բlϼD#l{_ܲ}_KA=4#[?8?o֎(Վ[T˷uJK2|Kw_Ǒ.Z ݻ 6?~kכF2V\\~w/w en(.߆ ߾H/;iS%̩_˕i\/r8E?S[N1nǎ7zx#"nX~os9ۛ_^éyWzV .sėɧ>{sݔO}W^JC<*x+}8 [ͤk<5i.j;xCgzQ 2 Q3"~DR 洇> Mg+}_ A~*di)%?OJS&b~t_Ch=6 oN"ҀT!B RyH
BdA=< 4 ɨC`؆ p=C/{o6̆6;]\3d! ~&ȴv:Ҽ= !єdb
yS$^DM8
˚T< mdgId33]wa
L_C7&~7;9<Q$ ԭf3-[yDОl ܅EԳi jk굳'z{;gƳUf'Re9!ib~?bPb<:Q/嵸W6?2EqUޭfVS% clNPUjAc^9bsZ+VCwwS^\\aÍ; hW1{UEka ͱh=}p { /S? jk6GnhRoU$2TG.qqXM:B x +VöQKG^A ߄GJ?Ϥj-~4Ddt#w
8M&& 0K~j4
Rʕ_ Hf6j8r2 eZݬ^Ul: <E'"k=prI铞MW8 ~Y:< ` ( 3 h ( ` R