Offline Domain Join -Trust Requirements
In order to successfully facilitate the new Cached Credentials job (which supports the Offline Domain Join feature) a one-way external trust must be configured from the source domain to the target domain (source trusts target).
Cached Credentials will validate and cache the login of a target user account prior to a workstation cutover so that they may successfully login to the target forest after cutover without the need to be on the network for the first login which for remote users is typically a challenge. In order to facilitate the caching of target user accounts the workstations being migrated must be allowed to use the target user accounts for authentication which is why the dependency of a one-way trust is required.
With the addition of the one-way trust we can establish a selective authentication model to limit and restrict the access of target objects to explicitly chosen target accounts and source resources by source forest administrators.
Figure 1 – Source Forest with a 1-way trust to the Target AD Forest
Offline Domain Join - Trust Options
When setting up a forest trust you have the options of limiting the direction of the trust (incoming vs outgoing), 1-way or 2-way as well the scope of authentication. With an Active Directory Trust, you can perform Forest-wide authentication or Selective Authentication.
Forest-wide Authentication
With Forest-wide authentication users from the trusted forest can automatically authenticate for all resources in the local forest.
Selective Authentication (Recommended Method)
When using the Selective Authentication model, users from the trusted forest are not automatically granted the permission to authenticate to resources in the local forest and must be explicitly giving the permission to authenticate. This is the preferred method for handling trust relationships between two different organizations or where you want to limit the access you grant the trusted forest.
For Offline Domain Join purposes we can use selective authentication to limit the access of the target accounts that have the ability to perform the cache credential steps as well as limit the computer objects where these accounts have the ability to authenticate from which greatly limits the security implications of establishing a trust during an ongoing Active Directory Migration since the source domain is in complete control of where target authentication is allowed to be performed in the local forest.
Figure 2 – Authentication Models for Outgoing Trust Relationships