Domain trust enumeration is the discovery and mapping of trust relationships between Active Directory domains and forests. It is used to identify which security principals can authenticate across boundaries, which paths exist for lateral movement, and where privileged access may extend beyond the local domain.
What Domain Trust Enumeration Reveals
Domain trust enumeration is not just a directory discovery exercise, it is a way to expose where one AD domain can reach another, which principals can cross those boundaries, and how far privileged access may extend if a trust is abused. That makes the output directly useful for attack path analysis and boundary review.
When defenders understand the trust graph, they can see where authentication is allowed across domains, where a one-way trust still creates asymmetric exposure, and where forest-level relationships may widen the blast radius of a compromise. The important question is not only whether a trust exists, but what that trust permits in practice.
How Trust Enumeration Works in Active Directory
Enumerating trust relationships usually starts with looking at the directory objects and attributes that describe domain and forest trusts, then validating the effective direction, transitivity, and scope of those links. In practice, this often means correlating directory data with authentication paths, delegated admin reach, and selective authentication settings.
The resulting map can show whether a domain is isolated, partially connected, or effectively extended into a broader security boundary. For a practical walkthrough of the trust model, Active Directory Trusts and SID Filtering Guide explains how domain and forest trusts work, including the controls that narrow their exposure.
Why Trust Boundaries Matter for Lateral Movement
Trusts matter because they can turn a local compromise into a cross-domain one. If an attacker gains a foothold in a domain that participates in a trust relationship, they may use permitted authentication paths, token delegation, or misconfigured trust settings to move laterally into higher-value environments.
That is especially dangerous when trusts connect administrative domains, child and parent domains, or separate forests that were assumed to be isolated. A clear enumeration of trust paths helps identify where a single compromised account, ticket, or privileged group membership could extend beyond its intended scope.
For defenders studying discovery and attack-path behavior, Discovery and Reconnaissance Techniques Guide covers the reconnaissance patterns commonly used to map trust relationships before follow-on abuse.
Trust Enumeration, Identity Scope, and Privileged Access
Domain trust enumeration is also an identity governance problem because it shows where authentication authority is shared, where trust is inherited, and which administrative roles may have influence outside the local domain. In mature environments, the trust graph should be treated as part of the identity attack surface, not just as topology metadata.
The security impact is often about scope creep: a service account, admin group, or federated identity may be valid in more places than the original owners realise. A broader reference architecture helps position that risk within the overall identity design, and Identity reference architecture for workforce, customer and non-human identities is useful when you need to relate trust boundaries to the larger identity control plane.
For trust abuse that crosses domain or federation boundaries, Federation and Trust Relationships Guide is the most direct companion piece because it covers AD trusts, forest trusts, and related cross-boundary exposure patterns.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1482 — Domain Trust Discovery | Directly covers discovering domain trust relationships and cross-domain attack paths. |
| Recommendation — Map trust enumeration activity to T1482 and hunt for trust discovery before lateral movement begins. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Trust enumeration exposes where account reach and authentication scope extend across domains. |
| AC-6 — Least Privilege | Trust relationships can overextend privilege beyond the local domain boundary. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Trust changes and trust abuse are detectable through directory and authentication auditing. | |
| Recommendation — Review and restrict cross-domain account reach under AC-2 wherever trust paths expand access. Apply AC-6 to reduce cross-domain privilege exposure created by trust relationships. Use AU-6 to review trust-change and trust-abuse events in directory audit data. | ||