Trust queries expose external domain relationships, trust accounts, trusted domain objects, and foreign security principals. We use them to identify inbound/outbound paths, cross-domain group membership, SID filtering questions, and where to query next.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Trusted domain objects:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(objectClass=trustedDomain)' trustPartner trustDirection trustAttributes flatName securityIdentifier
Trust accounts:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(samAccountType=805306370)' samAccountName distinguishedName userAccountControl
Foreign security principals:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(objectClass=foreignSecurityPrincipal)' cn memberOf distinguishedName
Foreign security principals in a trusted domain:
ldapsearch -LLL -x -H ldap://partner-dc.partner.com -D 'PARTNER\user' -w 'Password123!' -b 'DC=partner,DC=com' '(objectClass=foreignSecurityPrincipal)' cn memberOf distinguishedName
nxc ldap $DC -d OOTW -u $USER -p "$PASS" -M get-trusts
PowerShell:
Get-ADTrust -Filter * -Properties * | Select-Object Name,Direction,TrustType,TrustAttributes,Target
Get-ADObject -LDAPFilter '(objectClass=foreignSecurityPrincipal)' -Properties memberOf