Question
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest contains the domain controllers shown in the following table.
| Name | Operations master role |
|---|---|
| DC1 | Schema master |
| DC2 | Infrastructure master |
| DC3 | Domain naming master |
| DC4 | PDC emulator, RID master |
You have a partner organization that has an AD DS forest named fabrikam.com.
You create a trust relationship between contoso.com and fabrikam.com.
You need to configure selective authentication for the trust relationship.
Which domain controller should be granted permissions to fabrikam.com?
- A. DC1
- B. DC2
- C. DC3
- D. DC4 Correct
Explanation
DC4 holds the PDC emulator role. After the NTLM pass-through authentication protections (CVE-2022-21857), a trust that uses selective authentication needs the PDC emulator of the forest root domain to be granted the Allowed to Authenticate permission on the domain controller computer accounts in the partner forest. It also needs read access to the partner forest's configuration partition, so that it can validate pass-through requests across the trust. The schema master, infrastructure master, and domain naming master roles (DC1, DC2, DC3) play no part in this check.
