Windows Server 2025: a unidirectional trust does not isolate an Active Directory forest

Attack Techniques & Methods2026-10-30, 08:19
Windows Server 2025: a unidirectional trust does not isolate an Active Directory forest
An Active Directory forest has traditionally been considered a security boundary, based on the assumption that trust relationships between forests do not grant administrative control over another forest. However, research shows that this assumption is not always valid. Jorge's Quest For Knowledge examines a previously known technique for abusing unidirectional trusts (forest or external) from the trusting forest and tests it against modern versions of Windows Server, including Windows Server 2025. The main conclusion: despite the introduction of new security mechanisms, the attack remains possible.
How does the technique work? If an attacker gains administrative control over the trusting forest, they can extract the trust credentials (the cryptographic keys associated with the trust account) from the forest's NTDS.DIT database. These credentials can then be used to request a TGT for the trust account in the trusted forest.
What changed in Windows Server 2025? By default, a trust account has primaryGroupID = 513, meaning it belongs to Domain Users. Once the first Windows Server 2025 writable domain controller (RWDC) is introduced and the PDC FSMO role is transferred to it, two global security groups are created: • Forest Trust Accounts (RID 528), for forest trusts • External Trust Accounts (RID 529), for external trusts As a result, resources protected by the Domain Users or Users groups are no longer accessible to trust accounts. These changes were expected to also prevent trust accounts from authenticating to the trusted domain and performing reconnaissance. However, the research demonstrates that this is not the case.
Why does the attack still work? The researcher tested three scenarios on Windows Server 2022 and 2025 domain controllers:
  1. Obtaining a TGT with an AES256 key: • Against the Windows Server 2022 domain controller, requesting a TGT for a trust account using an AES256 key succeeded. The new groups are not enforced on Windows Server 2022, and filtering by primaryGroupID does not block authentication itself. • Against Windows Server 2025, the request also succeeded. The new security groups do not prevent trust accounts from obtaining a TGT because the trust account still exists and is remains enabled.
  2. Obtaining a TGT using an RC4 key: • Against Windows Server 2022, the request failed, most likely due to the recent deprecation of RC4. • Against Windows Server 2025, it also failed because Windows Server 2025 domain controllers do not support RC4.
  3. Obtaining a TGT using an AES128 key: against Windows Server 2025 and Windows Server 2022, the request succeeded.
Conclusion: changing the primaryGroupID from 513 to 528 or 529 does not disable trust accounts or prevent authentication. As long as a supported encryption algorithm (AES128 or AES256) is available, an attacker can still obtain a TGT for the trust account. RC4 is not required.
Article: https://jorgequestforknowledge.wordpress.com/2026/07/09/the-ad-forest-as-a-security-boundary-and-the-impact-of-trusts-on-that-security-boundary-the-revisited-still-insecure-sequel/
Vendors
Products