> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/ad/trusted_by.md).

# TRUSTED\_BY

## Summary

|                            |             |
| -------------------------- | ----------- |
| **FSProtect ACL Alias**    | TRUSTED\_BY |
| **Affected Object Types**  | Domains     |
| **Exploitation Certainty** | Unlikely    |

## Description

The `TRUSTED_BY` permission in Active Directory establishes a trust relationship where an account or system is explicitly recognized as reliable by another domain (or security principal). This trust designation is crucial for inter-domain authentication, delegated access, and secure interactions between systems, ensuring seamless collaboration while maintaining security boundaries. Proper configuration of the `TRUSTED_BY` permission allows for controlled delegation of access rights, reducing redundant authentication prompts and streamlining cross-domain operations.

However, if misconfigured, the `TRUSTED_BY` permission can introduce significant security vulnerabilities. An attacker who exploits this trust relationship could abuse the trust to impersonate trusted accounts, escalate privileges, or bypass access controls within the trusted environment. Such exploitation might enable unauthorized access to sensitive systems, facilitate credential theft, and lead to widespread compromise of interconnected domains.

## Identification

### PowerShell

#### Active Directory Module

Using the ActiveDirectory PowerShell module, you can enumerate `TRUSTED_BY` entries.

**1.** Find-ADTrusts function

**2.** Get all domain trusts

```powershell
function Find-ADTrusts {
    [CmdletBinding()]
    param([string]$OutputPath = ".\ADTrusts.csv")
    try { $trusts = Get-ADTrust -Filter * -Properties Name,Direction,Source,TrustType}
    catch {Write-Error "Failed to enumerate trusts: $($_.Exception.Message)"; return}
    $rows = foreach ($t in $trusts) {
        [pscustomobject]@{
            Source    = $t.Source
            Name      = $t.Name
            Direction = $t.Direction
            Type      = $t.TrustType
        }
    }
    if ($rows) { $rows | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8 ; $rows }
    else { Write-Host "No trust objects found." }
}
```

#### .NET Directory Services

By leveraging PowerShell’s built-in .NET DirectoryServices namespace, you can enumerate `TRUSTED_BY` entries without relying on any external modules or dependencies.

**1.** Find-ADTrustSimple function

```powershell
function Find-ADTrustSimple {
    [CmdletBinding()]
    param([string]$OutputPath = ".\ADTrusts.csv")
    try {
        $baseDN     = ([ADSI]"LDAP://RootDSE").defaultNamingContext
        $searchRoot = [ADSI]("LDAP://CN=System,$baseDN")
        $ds = [System.DirectoryServices.DirectorySearcher]::new($searchRoot)
        $ds.Filter = "(objectClass=trustedDomain)"; $ds.PageSize = 1000
        foreach ($p in "name","trustDirection","trustType") { [void]$ds.PropertiesToLoad.Add($p) }
        $src = if ($env:USERDNSDOMAIN) { $env:USERDNSDOMAIN } else { ($baseDN -replace 'DC=','' -replace ',','.') }
        $rows = foreach ($r in $ds.FindAll()) {
            $p = $r.Properties
            [pscustomobject]@{
                Source    = $src
                Name      = $p["name"][0]
                Direction = if ($p["trustdirection"]) { @("Disabled","Inbound","Outbound","Bidirectional")[[int]$p["trustdirection"][0]] } else { "Unknown" }
                Type      = if ($p["trusttype"]) { switch([int]$p["trusttype"][0]) { 1{"Downlevel"} 2{"Uplevel"} 3{"MIT"} 4{"DCE"} default{"Unknown"} } } else { "Unknown" }
            }
        }
    } catch { Write-Error "LDAP enumeration failed: $($_.Exception.Message)"; return }
    if ($rows) { $rows | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8; $rows }
    else { Write-Host "No trust objects found." }}
```

**2.** Get all domain trusts

```powershell
Find-ADTrustSimple
```

### Active Directory Domains and Trusts

**1.** Open `Active Directory Domains and Trusts`.

**2.** Click on your domain.

**3.** You can see trusted domains in the list

**4.** Click OK to close the dialogs.

![Active Directory Domains and Trusts](/files/AIDlodb9L5OotDVIYJu1)

## Exploitation

The `TRUSTED_BY` relationship is a trust link between two domains. It does not directly grant privileges, but it enables accounts in one domain to be recognized and authenticated by another.

## References

* [Trusts - The Hacker Recipes](https://www.thehacker.recipes/ad/movement/trusts/)
* [Forest trusts in Microsoft Entra Domain Services](https://learn.microsoft.com/en-us/entra/identity/domain-services/concepts-forest-trust)