\subsubsection{Windows domain trusts Samba domain}


\paragraph{Windows NT}
\label{vertrauen-win-samba-nt}
\begin{enumerate}
\item The user manager \ucsName{usrmgr.exe} must be started on the
  Windows PDC and selected in the menu \ucsMenuEntry{Policies
    \ucsRightArrow{} Trust Relationships \ucsRightArrow{}
    Trusted domains \ucsRightArrow{} [Add]}.

\item The NetBIOS name of the Samba domain must be entered in the
  input field \ucsMenuEntry{Domain} and the password of the domain
  trust account entered in the input field
  \ucsMenuEntry{Password}. Clicking \ucsButton{OK} prompts the message
  \ucsMenuEntry{The trust relationship with <Name of Samba domain> has been set up successfully.}
\end{enumerate}

\paragraph{Windows 2000}
\label{vertrauen-win-samba-w2k}

\begin{enumerate}
\item The menu for trust relationships can be found under
  \ucsMenuEntry{Start \ucsRightArrow{} Programs \ucsRightArrow{}
    Administrative tools \ucsRightArrow{} User manager for domains} on the Windows PDC. Right clicking on the
  personal domain opens the \ucsMenuEntry{Properties} dialogue.

\item Following selection of \ucsMenuEntry{Trust relationships
    \ucsRightArrow{} Trusting domains \ucsRightArrow{}
    [Add]}, the NetBIOS name of the Samba domain can be
  entered in the input field \ucsMenuEntry{Trusting Domain} and the
  password of the domain trust account can be entered in the input
  field \ucsMenuEntry{Initial password}. The password must be repeated.
  Clicking \ucsButton{OK} set up the trust relationship. If the
  procedure is successful, a confirmation message is displayed, which
  can be confirmed with \ucsButton{OK}.
\end{enumerate}

\paragraph{Windows 2003}~\\
\label{vertrauen-win-samba-w2k3}
\ucsNote{The documentation was based on \ucsName{Windows Server 2003
    Standard Edition}.}

\begin{enumerate}
\item The menu for trust relationships on the Windows PDC can be
  reached via \ucsMenuEntry{Start \ucsRightArrow{} Administrative Tools
    \ucsRightArrow{}  Active Directory Domains and Trusts}. Right clicking on the personal domain
  opens the \ucsMenuEntry{Properties} dialogue.

\item When \ucsMenuEntry{Trusts \ucsRightArrow{} New Trust} is
  selected, the \ucsMenuEntry{New Trust Wizard} is opened and must be
  confirmed with \ucsButton{Next}.

\item Once the NetBIOS name of the Samba domain has been entered,
  this must also be confirmed with \ucsButton{Next}.

\item \ucsMenuEntry{One-way: outgoing} must be selected as the
  direction for the trust relationship and confirmed with
  \ucsButton{Next}.

Three functions are available:

A unidirectional trust relationship is a connection created between
two domains for authentication in one direction. This means that in a
unidirectional trust relationship between domain A and domain B, the
users in domain A have access to the resources in domain B. The users
in domain B do not, however, have accesses to the resources in domain
A. If such a trust relationship is to be set up in domain A, the
\ucsMenuEntry{One-way: outgoing} function should be
selected. If domain B should receive this permission,
\ucsMenuEntry{One-way: incoming} should be selected in domain
A. In \ucsMenuEntry{One-way relationships} it is important to
note whether the connection is to be \emph{transitive} or not.

The transitivity determines whether a trust relationship can be
expanded on domains apart from the two domains in which it was
created. A transitive trust relationship can be used to expand trust
relationships on other domains whilst non-transitive ones do not allow
this expansion.

In a bidirectional trust relationship domain A trusts domain B and
domain B trusts domain A. This means that the authentication
requests  are exchanged in both directions between the two domains.

\item If users from the Samba domain should be made equal to users
  from Windows domains, \ucsMenuEntry{Domain-wide authentication}
  must be activated. If users from the Samba domain should only be
  endowed with certain permissions in the Windows domain,
  ucsMenuEntry{Selective authentication} is sufficient. The
  permissions can be configured in Windows once the trust relationship
  has been concluded. \ucsButton{Next} must then be clicked to move
  to the next dialogue.

\item Once the domain trust account password has been given in the
  input fields \ucsMenuEntry{Trust password} and
  \ucsMenuEntry{Confirm trust password},
  \ucsButton{Next} is used to pass to the next setting.

\item Once the settings for the trust relationship have been checked,
  any necessary changes can be made. Clicking \ucsButton{Next}
  creates the trust relationship.

\item This step simply shows the changes made. \ucsButton{Next} is
  used to pass to the next step.

\item When it has been verified that a domain trust account has been
  created and a connection can be made to the PDC, \ucsMenuEntry{Yes,
    confirm the outgoing trust.} must be activated and
  \ucsButton{Next} selected.

\item The change status \ucsMenuEntry{The trust relationship was successfully created and confirmed. }
is now shown and this step confirmed with \ucsButton{Finish}.
\end{enumerate}


\subsubsection{Samba domain trusts Windows domain}

\paragraph{Windows NT}
\label{vertrauen-samba-win-nt}
\begin{enumerate}
\item The user manager \ucsName{usrmgr.exe} must be started on the
  Windows PDC and selected in the menu \ucsMenuEntry{Policies
    \ucsRightArrow{} Trust relationships \ucsRightArrow{}
    Trusted domains \ucsRightArrow{} Add}.

\item The NetBIOS name of the Samba domain must be entered in the
  input field \ucsMenuEntry{Account for domain} and a password of
  your choice entered in the input field \ucsMenuEntry{Password}. Once
  the password has been confirmed, the set-up can be completed by
  clicking on \ucsButton{OK}.

\end{enumerate}

\paragraph{Windows 2000}
\label{vertrauen-samba-win-w2k}
\begin{enumerate}
\item After selecting \ucsMenuEntry{Start \ucsRightArrow{} Programs
    \ucsRightArrow{} Administrative tools \ucsRightArrow{} User
    manager for domains} on the Windows PDC,
  right clicking on the individual domain and selecting
  \ucsMenuEntry{Properties \ucsRightArrow{} Trust relationships
    \ucsRightArrow{} Trusting domains
    \ucsRightArrow{} \ucsButton{Add}} opens the set-up
  dialogue. The NetBIOS name of the Samba domain must be entered in
  the input field \ucsMenuEntry{Trusting domain} and a password of
  your choice entered in the input field \ucsMenuEntry{Password}. Once
  the password has been repeated, this can be confirmed with \ucsButton{OK}.

\item If the message \ucsMenuEntry{To verify the new trust, you must
    have permissions to administer trusts for the domain 'Name of
    Samba domain'. Do you want to verify the new trust?} appears, it
  should be declined with  \ucsButton{No}.
\end{enumerate}

\paragraph{Windows 2003}
\label{vertrauen-samba-win-w2k3}

\ucsNote{The documentation was based on \ucsName{Windows Server 2003 Standard Edition}.}

\begin{enumerate}
\item After selection of \ucsMenuEntry{Start \ucsRightArrow{}
    Administrative tools \ucsRightArrow{} User manager for domains} on
  the Windows PDC, right clicking on the individual domain opens the
  \ucsMenuEntry{Properties} dialogue.

\item The Windows domain must be operated in mixed mode. This is
  displayed on the \ucsMenuEntry{General} tab by
  \ucsMenuEntry{Domain mode: Windows 2000 mixed mode}.

\item Following selection of \ucsMenuEntry{Trust relationships
    \ucsRightArrow{} \ucsButton{New trust relationship}} the
  assistant for new trust relationships opens, which can be continued
  with \ucsButton{Next}.

\item The NetBIOS name of the Samba domain must be entered in the
  input field \ucsMenuEntry{Name}; this must be confirmed with
  \ucsButton{Next}.

\item The connection should be configured as \ucsMenuEntry{Intransitive}
  to suppress access to the resources of domains with
  which the Windows domain already has entered into a trust
  relationship.

\item \ucsMenuEntry{One-way incoming} must be selected as the
  direction for the trust relationship and confirmed with
  \ucsButton{Next}.

\item Following entry of a password into the input fields
\ucsMenuEntry{Trust password}, \ucsButton{Next} must be clicked.

\item Following verification of the settings for the trust
  relationship and performance of any necessary changes, the trust
  relationship can be established by clicking \ucsButton{Next}.

\item The changes shown must be confirmed \ucsButton{Next}.

\item \ucsMenuEntry{No, do not confirm the incoming trust} should be
  selected and confirmed with \ucsButton{Next}.

\item The displayed change status of \ucsMenuEntry{The trust relationship was successfully created and confirmed.} 
  must be confirmed by clicking on \ucsButton{Fertig stellen}.

\item The trust relationship is displayed under \ucsMenuEntry{Trusted
    domains (outgoing trust relationship)}
\end{enumerate}
