> For the complete documentation index, see [llms.txt](https://duc193.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://duc193.gitbook.io/notes/redteam/active-directory/domain-trusts-primer/2.-enumerating-trust-relationships.md). # 2. Enumerating Trust Relationships ### **Using Get-ADTrust :** ```jsx Import-Module activedirectory Get-ADTrust -Filter * # Result Direction : BiDirectional DisallowTransivity : False DistinguishedName : CN=LOGISTICS.INLANEFREIGHT.LOCAL,CN=System,DC=INLANEFREIGHT,DC=LOCAL ForestTransitive : False IntraForest : True IsTreeParent : False IsTreeRoot : False Name : LOGISTICS.INLANEFREIGHT.LOCAL ObjectClass : trustedDomain ObjectGUID : f48a1169-2e58-42c1-ba32-a6ccb10057ec SelectiveAuthentication : False SIDFilteringForestAware : False SIDFilteringQuarantined : False Source : DC=INLANEFREIGHT,DC=LOCAL Target : LOGISTICS.INLANEFREIGHT.LOCAL TGTDelegation : False TrustAttributes : 32 TrustedPolicy : TrustingPolicy : TrustType : Uplevel UplevelOnly : False UsesAESKeys : False UsesRC4Encryption : False Direction : BiDirectional DisallowTransivity : False DistinguishedName : CN=FREIGHTLOGISTICS.LOCAL,CN=System,DC=INLANEFREIGHT,DC=LOCAL ForestTransitive : True IntraForest : False IsTreeParent : False IsTreeRoot : False Name : FREIGHTLOGISTICS.LOCAL ObjectClass : trustedDomain ObjectGUID : 1597717f-89b7-49b8-9cd9-0801d52475ca SelectiveAuthentication : False SIDFilteringForestAware : False SIDFilteringQuarantined : False Source : DC=INLANEFREIGHT,DC=LOCAL Target : FREIGHTLOGISTICS.LOCAL TGTDelegation : False TrustAttributes : 8 TrustedPolicy : TrustingPolicy : TrustType : Uplevel UplevelOnly : False UsesAESKeys : False UsesRC4Encryption : False ``` ### **Using Get-DomainTrust :** ```jsx PS C:\\htb> Get-DomainTrust SourceName : INLANEFREIGHT.LOCAL TargetName : LOGISTICS.INLANEFREIGHT.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : WITHIN_FOREST TrustDirection : Bidirectional WhenCreated : 11/1/2021 6:20:22 PM WhenChanged : 2/26/2022 11:55:55 PM SourceName : INLANEFREIGHT.LOCAL TargetName : FREIGHTLOGISTICS.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : FOREST_TRANSITIVE TrustDirection : Bidirectional WhenCreated : 11/1/2021 8:07:09 PM WhenChanged : 2/27/2022 12:02:39 AM ``` ### **Using Get-DomainTrustMapping:** ```jsx PS C:\\htb> Get-DomainTrustMapping SourceName : INLANEFREIGHT.LOCAL TargetName : LOGISTICS.INLANEFREIGHT.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : WITHIN_FOREST TrustDirection : Bidirectional WhenCreated : 11/1/2021 6:20:22 PM WhenChanged : 2/26/2022 11:55:55 PM SourceName : INLANEFREIGHT.LOCAL TargetName : FREIGHTLOGISTICS.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : FOREST_TRANSITIVE TrustDirection : Bidirectional WhenCreated : 11/1/2021 8:07:09 PM WhenChanged : 2/27/2022 12:02:39 AM SourceName : FREIGHTLOGISTICS.LOCAL TargetName : INLANEFREIGHT.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : FOREST_TRANSITIVE TrustDirection : Bidirectional WhenCreated : 11/1/2021 8:07:08 PM WhenChanged : 2/27/2022 12:02:41 AM SourceName : LOGISTICS.INLANEFREIGHT.LOCAL TargetName : INLANEFREIGHT.LOCAL TrustType : WINDOWS_ACTIVE_DIRECTORY TrustAttributes : WITHIN_FOREST TrustDirection : Bidirectional WhenCreated : 11/1/2021 6:20:22 PM WhenChanged : 2/26/2022 11:55:55 PM ``` ### **Checking Users in the Child Domain using Get-DomainUser :** ```jsx PS C:\\htb> Get-DomainUser -Domain LOGISTICS.INLANEFREIGHT.LOCAL | select SamAccountName samaccountname -------------- htb-student_adm Administrator Guest lab_adm krbtgt ``` ### **Using netdom to query domain trust :** ```jsx C:\\htb> netdom query /domain:inlanefreight.local trust Direction Trusted\\Trusting domain Trust type ========= ======================= ========== <-> LOGISTICS.INLANEFREIGHT.LOCAL Direct Not found <-> FREIGHTLOGISTICS.LOCAL Direct Not found The command completed successfully. ``` ### **Using netdom to query domain controllers :** ```jsx C:\\htb> netdom query /domain:inlanefreight.local dc List of domain controllers with accounts in the domain: ACADEMY-EA-DC01 The command completed successfully. ``` ### **Using netdom to query workstations and servers :** ```jsx C:\\htb> netdom query /domain:inlanefreight.local workstation List of workstations with accounts in the domain: ACADEMY-EA-MS01 ACADEMY-EA-MX01 ( Workstation or Server ) SQL01 ( Workstation or Server ) ILF-XRG ( Workstation or Server ) MAINLON ( Workstation or Server ) CISERVER ( Workstation or Server ) INDEX-DEV-LON ( Workstation or Server ) ...SNIP... ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://duc193.gitbook.io/notes/redteam/active-directory/domain-trusts-primer/2.-enumerating-trust-relationships.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.