AD Trust Configuration Anomaly and Discovery Response
When a trust discovery alert, trust configuration change, or foreign security principal anomaly is received without evidence of an active attack, audit the trust structure, roll back unauthorized changes, and apply permanent hardening.
Prepare
9 steps- Trust Inventory
Document and keep all trust relationships current: `Get-ADTrust -Filter * | Select-Object Name, TrustType, TrustDirection, TrustAttributes`
- SID Filtering Status
Decode TrustAttributes bits for each trust; record Quarantine (0x4), Selective Auth (0x10), and WithinForest (0x20) status in the approved baseline: `Get-ADObject -Filter {objectClass -eq 'trustedDomain'} -Properties TrustAttributes | Select-Object Name, @{n='Quarantine';e={($_.TrustAttributes -band 0x4) -ne 0}}, @{n='SelectiveAuth';e={($_.TrustAttributes -band 0x10) -ne 0}}, @{n='EnableTGTDeleg';e={($_.TrustAttributes -band 0x200) -ne 0}}`
- sIDHistory Inventory
If migration is complete, scan and clear the sIDHistory attribute on all accounts: `Get-ADUser -Filter * -Properties sIDHistory | Where-Object {$_.sIDHistory}`
- ForeignSecurityPrincipals Inventory
Document the FSP container and flag residual objects: `Get-ADObject -SearchBase "CN=ForeignSecurityPrincipals,DC=corp,DC=local" -Filter * -Properties *`
- EnableTGTDelegation Status
Confirm the 0x200 bit is zero on forest trusts after KB4490425; should default to No on patched DCs.