读取windows nltest /server /domain_trust输出

Question

我想快速了解我们在AD环境中有多少信托基金，所以我使用了nltest /server:<domain controller host> /domain_trusts /all_trusts

找出1和2方面的信任是很容易的，但是我找不到其他一些正在显示的输出的文档。例如：

0: MYDOMAIN mydomain.test.net (NT 5) (Forest: 1) (Direct Outbound) (Direct Inbound) ( Attr: 0x20 )
1: TEST test.net (NT 5) (Forest Tree Root)
2: CHILD child.ey.net (NT 5) (Forest: 1)
3: SUBCHILD subchild.child.ey.net (NT 5) (Forest: 6)

我得到直接出站和入站，我假设"NT 5“只是服务器发布版本(如果我错了请纠正我)，但是返回的"Forest：#”数据是什么？我唯一能告诉你的是，对于子/子域来说，这个数字更高。

Answer 1

“林”显示“主域”是哪个条目2的成员。它根据返回的条目数进行更改。您可以通过为“/forest”关闭'/all_trusts‘来验证这一点。

PS C:\WINDOWS\system32> nltest /domain_trusts /all_trusts
List of domain trusts:
    0: DOMAIN.SUF (MIT) (Direct Outbound) ( Attr: non-trans 0x1000000 )
    1: FOREST FOREST.DOMAIN.SUF (NT 5) (Forest Tree Root) (Direct Outbound) (Direct Inbound)
    2: DOMAIN2 DOMAIN2.DOMAIN.SUF (NT 5) (Direct Inbound)
    3: CHILD CHILD.FOREST.DOMAIN.SUF (NT 5) (Forest: 1) (Primary Domain) (Native)
The command completed successfully

PS C:\WINDOWS\system32> nltest /domain_trusts /forest
List of domain trusts:
    0: FOREST FOREST.DOMAIN.SUF (NT 5) (Forest Tree Root) (Direct Outbound) (Direct Inbound)
    1: CHILD CHILD.FOREST.DOMAIN.SUF (NT 5) (Forest: 0) (Primary Domain) (Native)
The command completed successfully