Question
Your network contains an Active Directory Domain Services (AD DS) forest named contoso.com. The forest root domain contains a server named server1.contoso.com.
A two-way forest trust exists between the contoso.com forest and an AD DS forest named fabrikam.com. The fabrikam.com forest contains 10 child domains.
You need to ensure that only the members of a group named fabrikam\Group1 can authenticate to server1.contoso.com.
What should you do first?
- A. Add fabrikam\Group1 to the local Users group on server1.contoso.com.
- B. Enable SID filtering for the trust.
- C. Enable Selective authentication for the trust. Correct
- D. Change the trust to a one-way external trust.
Explanation
Selective authentication restricts access over an external or forest trust to only those users in a trusted domain who have been explicitly given authentication permissions. This feature is necessary to ensure that only members of fabrikam\Group1 can authenticate to server1.contoso.com.
